CVE-2023-29300

What it actually does

CVE-2023-29300 is an unauthenticated deserialization flaw in Adobe ColdFusion that allows a remote attacker to supply malicious serialized data that is processed by the ColdFusion runtime. Successful exploitation can cause attacker-controlled code to execute in the ColdFusion server process context, enabling full compromise of the application server, access to application files and secrets, command execution, web shell deployment, lateral movement, and service disruption. The vulnerability is network-reachable, low-complexity, requires no user interaction, and has complete confidentiality, integrity, and availability impact.

Why it matters to the business

A vulnerable internet-facing ColdFusion server can be taken over remotely without valid credentials, which can lead to theft of sensitive application data, compromise of connected systems, website defacement, ransomware deployment, prolonged outage, incident response costs, and regulatory exposure. This issue is listed in CISA KEV, has been used in ransomware campaigns, has active in-the-wild exploitation, and has an EPSS score near the maximum, so unpatched systems should be treated as high-priority exposure even though the vulnerability was published in 2023.

How an attack unfolds

An attacker typically scans for exposed Adobe ColdFusion instances and fingerprints the version or update level. If the server is running ColdFusion 2018 Update 16 or earlier, ColdFusion 2021 Update 6 or earlier, or ColdFusion 2023.0.0.330468 or earlier, the attacker sends a crafted request containing malicious serialized data to functionality handled by the ColdFusion runtime. During deserialization, the attacker-controlled object graph triggers code execution inside the ColdFusion Java process. The attacker then commonly validates command execution, writes a CFM/JSP web shell, downloads post-exploitation tooling, extracts configuration files and credentials, creates persistence through files or scheduled tasks, and may deploy ransomware or use the server as a foothold for lateral movement.

How to fix it

Upgrade Adobe ColdFusion immediately. Systems running ColdFusion 2018 Update 16 or earlier should be upgraded to Update 17 or later; ColdFusion 2021 Update 6 or earlier should be upgraded to Update 7 or later; ColdFusion 2023.0.0.330468 or earlier should be upgraded to Update 1 or later. Because this vulnerability is in CISA KEV, was due for remediation by 2024-01-29 for applicable U.S. federal systems, and is associated with ransomware activity, exposed systems should be patched or removed from the internet urgently. If immediate patching is not possible, restrict ColdFusion access to trusted networks, place it behind a VPN or authenticated reverse proxy, block unnecessary access to ColdFusion administrative and runtime endpoints, disable unused services, enforce least privilege on the ColdFusion service account, and monitor aggressively for exploitation. After patching, rotate credentials and secrets stored on or used by the ColdFusion server if compromise cannot be confidently ruled out.

How to confirm the fix worked

Confirm the installed ColdFusion major version and update level from the ColdFusion Administrator, Adobe update logs, or filesystem/version metadata, and verify it is at or above ColdFusion 2018 Update 17, ColdFusion 2021 Update 7, or ColdFusion 2023 Update 1. Validate that all public-facing instances, development systems, disaster recovery systems, containers, golden images, and cloned servers have been updated. Run authenticated vulnerability scans or configuration checks rather than relying only on external banner detection, because ColdFusion banners may be hidden or inaccurate. Confirm that administrative and sensitive ColdFusion paths are not directly reachable from untrusted networks. Review post-patch logs and EDR telemetry for evidence of pre-patch exploitation before declaring the risk resolved.

Typical attack path

1. Identify internet-facing Adobe ColdFusion servers through scanning, search engines, or prior asset lists.
2. Determine whether the server appears to be running a vulnerable ColdFusion release or update level.
3. Send a crafted unauthenticated request containing malicious serialized data to a vulnerable ColdFusion component.
4. Trigger deserialization inside the ColdFusion runtime and execute attacker-controlled operating-system commands.
5. Establish persistence by writing a web shell, modifying application files, creating scheduled tasks, or staging tooling.
6. Collect credentials, database connection strings, application source code, and configuration files from the ColdFusion installation.
7. Move laterally or deploy additional payloads, including ransomware, cryptominers, proxy tooling, or remote access malware.
8. Clean up obvious artifacts or blend activity into normal ColdFusion and web server traffic.

How to detect it

To determine whether exploitation already occurred, review ColdFusion logs, web server access logs, WAF logs, EDR telemetry, process creation logs, file integrity monitoring, and network egress records from the period before patching through the present. Focus on suspicious unauthenticated requests to ColdFusion paths, especially unusual POST requests, serialized payload patterns, deserialization or Java exception stack traces, and requests followed by ColdFusion process crashes or abnormal 500 responses. In endpoint telemetry, look for the ColdFusion Java process, ColdFusion service process, or web server worker spawning shells or scripting tools such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, bash, sh, curl, wget, certutil, bitsadmin, or python. Inspect ColdFusion webroots and application directories for recently added or modified .cfm, .cfc, .jsp, .jspx, .war, .jar, .class, .aspx, .php, and archive files. Review ColdFusion Administrator configuration, scheduled tasks, datasources, mappings, and runtime files for unexpected changes. Check for outbound connections from the ColdFusion server to unfamiliar IPs, paste sites, file-sharing services, tunneling services, or newly observed domains. Because this vulnerability is tied to ransomware activity, also hunt for credential dumping, mass file modification, suspicious archive creation, backup deletion, security-tool tampering, and lateral movement after the first suspicious ColdFusion event.

• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• curl http
• wget http
• /bin/sh -c
• bash -c
• Runtime.getRuntime().exec
• java.lang.ProcessBuilder
• <cfexecute
• cfexecute name=
• CreateObject("java", "java.lang.Runtime")
• CreateObject('java', 'java.lang.Runtime')
• ysoserial
• CommonsCollections
• wddxPacket
• cfusion/runtime/logs/coldfusion-out.log
• cfusion/runtime/logs/exception.log
• cfusion/runtime/logs/application.log
• cfusion/wwwroot/CFIDE
• wwwroot/CFIDE
• neo-cron.xml
• neo-datasource.xml
• neo-security.xml

What your security team should do

• Immediately inventory all Adobe ColdFusion deployments, including internet-facing, internal, staging, backup, and legacy servers.
• Patch vulnerable instances to ColdFusion 2018 Update 17 or later, ColdFusion 2021 Update 7 or later, or ColdFusion 2023 Update 1 or later; preferably move to the latest supported update level.
• Prioritize internet-facing systems first because exploitation is unauthenticated, actively used in the wild, and associated with ransomware activity.
• If patching is delayed, remove the server from direct internet exposure or restrict access to trusted source networks only.
• Hunt for evidence of compromise before and after remediation, focusing on suspicious ColdFusion child processes, newly created CFM/JSP files, unexpected scheduled tasks, and outbound connections from the ColdFusion process.
• Rotate credentials, API keys, database passwords, and service account secrets stored in ColdFusion configuration or application files if exploitation is suspected or logs are incomplete.
• Review ColdFusion service account privileges and reduce them so code execution does not automatically grant broad operating-system or network access.
• Enable or tune EDR alerts for web server or Java/ColdFusion processes spawning command shells, scripting interpreters, download utilities, archive tools, and remote access tools.
• Preserve relevant ColdFusion, web server, operating-system, EDR, and network logs before remediation if compromise is suspected.
• Add long-term SIEM detections for suspicious requests to ColdFusion endpoints, anomalous POST traffic, web shell creation, and ColdFusion-originated outbound command-and-control traffic.