Need help with /pms endpoint and CVE-2024-20767 & CVE-2023-38205

Hello team,

I'm Neh Patel, Penetration tester and security researcher.
Recenty i was conducting penetration test on a client's infrastructure where i got an old instance of Adobe ColdFusion.

After conducting a thorough analysis, we've discerned several vulnerabilities within this instance, which we believe could potentially pose significant security risks.

- CVE-2023-38205 - Access Control Bypass ( Bypass of CVE-2023-29298 )

- CVE-2024-20767 -  Local File Read

## A little introduction about above CVEs

### Part 1 :- CVE-2023-38205
As you know, When a request originates from an external IP address that is not present in the allow list, access to the requested resource is blocked 

Example : when you attempt to perform a remote method call wizardHash on the /CFIDE/wizards/common/utils.cfc endpoint from IP which is not in allowed list , the request fails due to the access control being in place 

CVE-2023-38205 allows an unauthenticated user/attacker to bypass this access control rule and allows us to access those endpoints which are meant to access from local network only
So we can access few endpoints which are meant to access from allowed IPs only with this CVE.

### Part 2 :- CVE-2024-20767
This CVE allows an unauthenticated user/attacker to read local file.

### Steps to read local file with CVE-2024-20767

To read local files with CVE-2024-20767, first of all, we have to retrive an "UUID" from following endpoint
ENDPOINT - 1  : CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat

This endpoint will return an "UUID" which will work as cookie or session id.

Now with that UUID, we have to send a request to following endpoint to READ the local file
ENDPOINT - 2 : /pms?module=logging

Now while sending request to above endpoint, the UUID will work as cookie or session ID.

### What's the problem 
In our case, all the endpoint are unaccessible as our IP is not in allowed IP list, so we used CVE-2023-38205 to bypass the Adobe ColdFusion's access control and we successfully send the request to "Endpoint - 1" and successfully obtained "UUID"

But while sending request to "ENDPOINT - 2", the request failed and returned "500 Internl Server Error".

Now in security community, you just can't report that this resource is vulnerable without showing them proper impact ( in this case, reading a local file will work as impact ).
So we are trying to use that UUID to read file which is not working.

## Our Questions :
1. Is it possible to use that UUID at some other endpoint ?
2.  I'm able to make a request to endpoint "CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat" as unauthneticated user, so is it possible to perform some action as unauthenticated user to some other endpoints ?
3. I tried changing "getHeartBeat" with few other methods from "ColdFusion Administrator API Reference", only method with "remote string <MethodName>" are working , so why i'm unable to request other methods ?

4. Is it possible to use this unauthenticated requests and create some more impact in my penetration test ?