Issue with graph.cfm on non-existent file

I’ve seen related issues come up e.g. (Error graph.cfm), but in my case, I am getting hit by a hacker that triggers calls to graph.cfm with made-up GUID image names - no idea why - like ~400,000 times day and keeps changing IP when I block. So my logs and papertrail are swamped with the stack trace from this exception from the graph.cfm code…

<cfif structKeyExists(url,"img") && structKeyExists(url,"type")>
	<cfcontent file="#GetTempDirectory()#/graph/#listLast(url.img,'/\#server.separator.file#')#" type="image/#url.type#"><cfsetting showdebugoutput="no">
<cfelse>
	<cfheader statuscode="404" statustext="Invalid Access">
</cfif>

He does provide a url.img and a url.type - so the 404 is not triggered.
The exception is
“file or directory [###/web-contexts/11972343f64841658ff7fb11ba374fbd/temp//graph/05549805-2105-4502-ABA2C8E18A1359AF.jpg] does not exist;lucee.runtime.exp.ExpressionException: file or directory [###/web-contexts/1197728df64841658ff7fb11ba374fbd/temp//graph/05549805-2105-4502-ABA2C8E18A1359AF.jpg] does not exist”

Originally I thought it was tied to some lucee bug where the “//” in temp//graph was the issue - but actually that seems irrelevant as lucee can figure that out. Lucee (quite reasonably) just throws an exception because the file isn’t there.

The only idea I have is to alter graph.cfm on my servers to add a check to see if the file exists (and check it whenever i upgrade), unless anyone has a better idea.
thanks

There was an similar issue filed at jira dealing with that marked as resolved and deployed.

https://luceeserver.atlassian.net/browse/LDEV-2120

However, the link provided in the ticket still throws an exception because of the same cause you’ve mentioned.

I’d do a workaround just as you suggested.

I’ve created a bug in Jira LDEV-4260 access graph.cfm with invalid query string throws file not exist error

2 Likes

Fix merged into 6.0.0.292, 5.3.10.89 and 5.3.9.168

1 Like