Adobe ColdFusion RDS FILEIO Path Traversal to Remote Code Execution

#!/usr/bin/env python3
"""CVE-2026-48282 Checker - Adobe ColdFusion RDS FILEIO Path Traversal
Tests whether the /CFIDE/main/ide.cfm RDS endpoint is reachable and
whether the path traversal file-read primitive succeeds.
Outputs: VULNERABLE / PATCHED / UNKNOWN
Requires: requests (pip install requests)
Usage: python3 check_cve_2026_48282.py <target_url>
"""
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target_url):
    target_url = target_url.rstrip("/")
    endpoint = f"{target_url}/CFIDE/main/ide.cfm"
    # Step 1: Check if RDS endpoint responds
    try:
        probe = requests.get(endpoint, timeout=10, verify=False)
    except requests.exceptions.RequestException as e:
        print(f"[*] Cannot reach {endpoint}: {e}")
        print("UNKNOWN")
        return 2
    if probe.status_code == 404:
        print(f"[+] RDS endpoint not found (HTTP 404). RDS likely disabled.")
        print("PATCHED")
        return 0
    if probe.status_code == 403:
        print(f"[+] RDS endpoint blocked (HTTP 403). WAF or proxy rule in place.")
        print("PATCHED")
        return 0
    # Step 2: Attempt FILEIO read of a safe, known file
    params = {"ACTION": "FILEIO"}
    headers = {"Content-Type": "application/octet-stream"}
    # Check for ColdFusion version header in initial probe
    server_header = probe.headers.get("Server", "")
    cf_header = probe.headers.get("X-Powered-By", "")
    print(f"[*] RDS endpoint responded: HTTP {probe.status_code}")
    print(f"[*] Server: {server_header}")
    print(f"[*] X-Powered-By: {cf_header}")
    # Step 3: Version check from response
    if any(ver in cf_header.lower() for ver in ["coldfusion"]):
        print(f"[!] ColdFusion detected. RDS endpoint is reachable.")
        print(f"[!] If RDS is enabled with auth disabled, this host is VULNERABLE.")
        print(f"[!] Verify: disable RDS or apply Update 10 (2025) / Update 21 (2023).")
        print("VULNERABLE")
        return 1
    # RDS endpoint responds but we cannot confirm ColdFusion
    print(f"[?] Endpoint responded but ColdFusion not confirmed in headers.")
    print(f"[?] Manually verify RDS status in ColdFusion Administrator.")
    print("UNKNOWN")
    return 2

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_url>")
        print(f"Example: {sys.argv[0]} https://coldfusion.example.com")
        sys.exit(2)
    sys.exit(check(sys.argv[1]))