Hackers are running a mass compromise against sites running vulnerable ColdFusion application server installations.

Security watchers at the SANS Institute's Internet Storm Centre are warning that a "high number" of sites have been hit over the last 36 hours or so. Miscreants are exploiting sites running older installations of some ColdFusion applications, such as FCKEditor (a popular HTML text editor) or CKFinder (an Ajax file manager).

Details of how to resolve this problem can be found on ColdFusion's site here.

The second strand of the attack relies on third party applications, in particular the CFWebstore e-commerce app, that incorporate vulnerable versions of FCKEditor.

Hackers are taking advantage of the vulnerabilities to plant malicious scripts onto compromised websites, as part of a drive-by download attack that ultimately aims to infect visiting surfers.

SANS reckons the crackers behind the attack are the same as the gang that pulled off a similar attack back in March. Security researchers urge sites to review their ColdFusion installations, paying particular attention to deleting older applications that may have been left around as orphans during systems upgrades. ®

Related stories

• Adobe patches 'critical' flaws in ColdFusion, JRun (18 August 2009)
• Latin Best Buy surfers sprayed by drive-by download malware (3 July 2009)
• Blue chip FTP logins found on cybercrime server (26 June 2009)
• Nine-ball attack splits security researchers (23 June 2009)
• Adobe buffs and brands full Flash suite (1 June 2009)
• New script outstrips all other drive-by download risks (15 May 2009)
• Conficker hype obscures sneaky botnet growth (6 May 2009)