CVE-2023-26359

What it actually does

This is an unauthenticated deserialization vulnerability that allows a remote attacker to submit crafted serialized data to a vulnerable Adobe ColdFusion component and cause server-side object deserialization to execute attacker-controlled code. Successful exploitation can result in arbitrary code execution with the privileges of the ColdFusion application service account, allowing file reads and writes, web shell deployment, command execution, credential access, and full compromise of the application host. The described affected Adobe versions are ColdFusion 2018 Update 15 and earlier and ColdFusion 2021 Update 5 and earlier; the supplied package metadata also references joomla/joomla-cms source fixed at commit 1dceaf228a25100963ee044e7c886244742ca0af and should be validated against the organization’s software inventory because it does not align with the Adobe ColdFusion product description.

Why it matters to the business

Because this vulnerability is remotely exploitable without authentication or user interaction and is listed in CISA KEV with active exploitation in the wild, exposed systems can be taken over directly from the internet. Business consequences include website defacement, service disruption, theft of application data, compromise of credentials stored on or reachable from the server, deployment of persistent web shells, and use of the server as a foothold for broader intrusion. The CISA KEV remediation deadline was 2023-09-11, so any remaining exposure should be treated as overdue and high priority even though ransomware use is not specifically indicated in the provided data.

How an attack unfolds

An attacker first identifies an internet-accessible ColdFusion instance running a vulnerable update level. They then send a specially crafted request containing malicious serialized data to a reachable ColdFusion endpoint that performs unsafe deserialization. When the application deserializes the untrusted object, a gadget chain or equivalent deserialization side effect causes code to run inside the ColdFusion server process. The attacker typically uses the initial execution to run operating-system commands, write a web shell into a web-accessible directory, enumerate local files and configuration, collect credentials, and establish persistence. After gaining stable access, the attacker may stage tools, proxy traffic through the server, access backend services, or move laterally depending on network reachability and the privileges of the ColdFusion service account. Public reporting and KEV status indicate this class of activity has been observed in the wild, though the provided threat actor field does not identify a specific named actor.

How to fix it

Upgrade affected Adobe ColdFusion deployments immediately. Adobe ColdFusion 2018 Update 15 and earlier should be updated to a fixed update level, starting with ColdFusion 2018 Update 16 or later where supported. Adobe ColdFusion 2021 Update 5 and earlier should be updated to ColdFusion 2021 Update 6 or later. Apply the latest available Adobe security updates rather than only the first fixed update, because subsequent updates may include additional hardening. If the supplied source-package metadata is applicable in a separate inventory context, ensure joomla/joomla-cms includes commit 1dceaf228a25100963ee044e7c886244742ca0af or a later known-good revision. Where immediate patching is not possible, restrict external access to ColdFusion administrative and framework paths, require VPN or trusted network access, block unnecessary ColdFusion endpoints at the reverse proxy or WAF, disable unused services and gateways, run ColdFusion with least-privilege service accounts, remove sample applications, and monitor aggressively for exploitation. Treat mitigation as temporary; patching is the durable fix.

How to confirm the fix worked

Confirm the installed ColdFusion product and update level from the ColdFusion Administrator, command-line package inventory, installation metadata, or Adobe update logs. Verify that ColdFusion 2018 systems are beyond Update 15 and ColdFusion 2021 systems are beyond Update 5, preferably on the latest supported update. Review the presence and timestamp of Adobe hotfix/update files and confirm the ColdFusion service was restarted after patching. From an external perspective, verify that administrative, sample, and unnecessary ColdFusion paths are not reachable from untrusted networks. Use vulnerability scanning or authenticated configuration assessment to confirm the vulnerable update level is no longer detected, but avoid sending weaponized deserialization payloads in production. If the joomla/joomla-cms package metadata is relevant, validate that the deployed source tree contains commit 1dceaf228a25100963ee044e7c886244742ca0af or a later revision. After remediation, review logs for exploitation attempts before and after the patch date to determine whether incident response is required.

Typical attack path

1. Scan for publicly reachable Adobe ColdFusion servers or known ColdFusion URL paths.
2. Fingerprint the ColdFusion version or infer vulnerable update levels from response behavior, headers, error pages, or exposed files.
3. Send a crafted unauthenticated request containing malicious serialized data to a vulnerable ColdFusion component.
4. Trigger unsafe server-side deserialization and achieve code execution in the ColdFusion process context.
5. Run reconnaissance commands such as user, hostname, process, network, and directory listing commands.
6. Drop or modify files, commonly including a web shell or script in a web-accessible directory.
7. Use the foothold to collect configuration files, database credentials, application secrets, or session material.
8. Establish persistence, stage additional tooling, exfiltrate data, disrupt services, or pivot to internal systems.

How to detect it

To determine whether exploitation already occurred, review web server access logs, reverse proxy logs, WAF events, ColdFusion logs, EDR process telemetry, file integrity monitoring, authentication logs, and network egress records for the period when the system was exposed before patching. Relevant ColdFusion logs commonly include application.log, exception.log, server.log, coldfusion-out.log, and coldfusion-error.log under the ColdFusion instance logs directory. Look for unauthenticated requests to ColdFusion-specific paths immediately followed by HTTP 500 errors, Java deserialization exceptions, suspicious ColdFusion stack traces, or new files written under web-accessible directories. On hosts, investigate java.exe, coldfusion.exe, jrun.exe, or the ColdFusion service process spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, curl, wget, bash, sh, perl, python, nc, or similar tools. Search for recently created or modified .cfm, .cfc, .jsp, .jspx, .asp, .aspx, or executable files in ColdFusion webroots, CFIDE directories, upload directories, and temporary directories. Review outbound connections from the ColdFusion host to unusual external IPs, especially shortly after suspicious HTTP requests. Also inspect scheduled tasks, cron entries, startup folders, services, new local users, SSH authorized_keys files, and modified application configuration files for persistence. If exploitation is suspected, preserve logs and disk artifacts before cleanup, isolate the host, perform credential rotation, and scope lateral movement from the ColdFusion service account.

• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.ObjectInputStream
• java.io.OptionalDataException
• java.io.WriteAbortedException
• ysoserial
• /CFIDE/
• /cf_scripts/
• /flex2gateway/
• /flashservices/gateway
• coldfusion-out.log
• coldfusion-error.log
• exception.log
• server.log
• application.log
• coldfusion.exe spawning cmd.exe
• jrun.exe spawning cmd.exe
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java.exe spawning /bin/sh
• java.exe spawning bash
• cmd.exe /c
• powershell -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• curl http
• wget http
• .cfm
• webshell.cfm
• cmd.cfm
• shell.cfm
• Runtime.getRuntime().exec
• ProcessBuilder(

What your security team should do

• Immediately inventory all Adobe ColdFusion instances, especially internet-facing systems, and identify versions 2018 Update 15 or earlier and 2021 Update 5 or earlier.
• Prioritize emergency patching because the vulnerability is unauthenticated, network-exploitable, high severity, and listed in CISA KEV with a missed remediation deadline of 2023-09-11.
• If patching cannot be completed immediately, restrict access to ColdFusion endpoints at the firewall, load balancer, reverse proxy, or WAF to trusted sources only.
• Hunt for prior compromise on all vulnerable or formerly vulnerable systems, including web shells, suspicious child processes, unexpected scheduled tasks, new users, modified ColdFusion files, and outbound connections.
• Rotate credentials and secrets stored on affected servers if there is any evidence of exploitation or if the system was internet-facing while vulnerable.
• Review ColdFusion service account permissions and reduce privileges to limit impact from future application-layer code execution.
• Add detections for ColdFusion or Java processes spawning command shells, script interpreters, archive utilities, download tools, or network utilities.
• Correlate web access logs, ColdFusion exception logs, EDR telemetry, and file integrity monitoring around suspicious HTTP 500 errors, deserialization exceptions, and new files in web-accessible directories.
• Validate whether the supplied joomla/joomla-cms fixed commit applies to any separately tracked application dependency and resolve any inventory-enrichment mismatch.