Cythera Cyber Security

FarCry Core Framework - Multiple Issues

FarCry Core contains multiple vulnerabilities that could let unauthenticated users upload arbitrary files and execute remote code on the hosting server.

Talk to an expert

Introduction

During an engagement, Cythera identified two critical security vulnerabilities in FarCry Core — an open-source web framework built for ColdFusion environments.

The Vulnerability

A broken access control flaw in FarCry’s default setup allows unauthenticated users to access sensitive features, including an unrestricted file upload mechanism. By leveraging this weakness, attackers can upload arbitrary files and execute them on the server, effectively achieving unauthenticated remote code execution (RCE) on the underlying web infrastructure.

Broken Access Control

The FarCry Core platform includes an access control check in the /webtop/Application.cfc file, which verifies whether users are authorised to access files within the /webtop directory. However, a subdirectory, /facade, includes its own Application.cfc file that overrides this behaviour. This version lacks access controls, effectively bypassing authentication and authorisation checks. As a result, attackers can access files under /webtop/facade without being authenticated.

‍

Unrestricted File Upload

Within the unprotected /facade directory, a file called upload.cfm accepts direct browser access. Due to verbose error messages, attackers can easily learn what parameters are required to perform a successful file upload. These include typename, property, fieldname, and current. Despite existing file upload restrictions elsewhere in FarCry, no allowlist is enforced here, enabling attackers to upload arbitrary files, such as a ColdFusion web shell, to server directories like /files/dmfile.

By uploading a file and accessing it through a browser, an attacker can gain unauthenticated remote code execution on the server.

‍

Proof of Concept

A simple HTTP request or command-line tool like curl can be used to upload a test file to the server, demonstrating the exploitability of the issue. These uploads bypass authentication due to the lack of access control in the /facade directory.

‍

Potential Impact

These issues allow an unauthenticated attacker to execute arbitrary code on the server, potentially resulting in complete compromise of the application and underlying infrastructure.

‍

How to Fix

Users are strongly encouraged to upgrade to the latest version of FarCry Core (7.2.14). More details can be found on the FarCry Core master branch hosted on GitHub.

‍‍
Vulnerability Disclosure Timeline

18 Oct 2023 – Issues disclosed to vendor
27 Oct 2023 – Patches committed to the master branch
29 May 2024
– CVEs assigned:
+ CVE-2024-35526 (Broken Access Control)
+ CVE-2024-35527 (Unrestricted File Upload)

31 May 2024 – Advisory publicly published

‍

CIO

Government Agency

Cythera operates as an extension of our team. When we call there is an immediate response and the person that answers our call is the person that resolves our issue. Cythera understands our network, and more importantly, has taken the time to understand our business. We find it easy to work with Cythera. They are approachable, flexible and have taken the time to build deep relationships with our team. It is a partnership and friendship. Cythera’s personalised, highly specialised services makes all the difference. We would recommend Cythera to anyone in the industry looking for a managed services partner.

Expert methods

We have the tools to pinpoint risks

Whether it’s hidden vulnerabilities or patterns you might miss, we help you stay one step ahead and make confident, informed decisions. Understand how our services can help your business uncover critical risks

Talk to an expert

Employee Cyber Training & Awareness

Your people are your first line of defence. Our cyber training builds awareness sharpens instincts and turns everyday staff into assets.

Advisory

When clarity is critical and stakes are high, our advisory services deliver strategic, executive-level security expertise that empowers decision-making and resilient operations.

Are you experiencing a security breach?

Incident Response

1300 298 437