CVE-2021-21307

This repository contains a detailed technical writeup on exploiting Lucee misconfigurations in Apple's infrastructure, including path traversal and RCE via CFM files. It discusses WAF bypass techniques and specific vulnerabilities in Lucee's admin panel.

The repository contains functional exploit code for CVE-2021-21307, an unauthenticated remote code execution vulnerability in Lucee Admin. The exploit leverages a file upload mechanism to deploy a malicious payload and achieve RCE.

This Metasploit module exploits an arbitrary file write vulnerability in Lucee Administrator's imgProcess.cfm to achieve remote code execution as the Tomcat user. It writes a CFML stub to execute commands via a POST request.