Question, deep under the hood. When someone invokes CFFILE for an upload, does the cf exe use Windows attrib.exe to check or modify the permissions of the upload? Our security team says there was a possible arbitrary code execution, and it seems like coldfusion.exe. launched attrib.exe to modify permission on a file that was uploaded via CFFILE.

Can the security team provide more details or is that an assumption they are making about the process? And also is there a demo of the process where the file is read only and somehow uploading it is converting it to All or write for example?

Probably, since you can set the attributes for the file with CFFILE.

Its an assumption. For sure.

Yea I agree with @Rodney but as for permissions that applies only to UNIX and Linux permissions.

Actually, you can set Windows permissions. Use

mode

for Linux and

attributes

for Windows.

@Rodney, that is how I was reading the provided documentation. I am asking the developer to confirm or deny the use of the attribute parameter on his cffile code.

CF wouldn't use attrib.exe to set file attributes/permissions. It would use the OS hooks in the JDK. Don't know if the security team is just looking for attribues to change, or if they really think the CF server is shelling out and running that command...