CVE-2023-38204

What it actually does

This vulnerability is an unauthenticated deserialization flaw in Adobe ColdFusion 2018 Update 18 and earlier, 2021 Update 8 and earlier, and 2023 Update 2 and earlier. A remote attacker can send specially crafted serialized data to a vulnerable ColdFusion endpoint and cause the server to deserialize attacker-controlled objects. Successful exploitation can execute arbitrary code in the context of the ColdFusion application service account, enabling full compromise of the application server, including file read/write, command execution, web shell deployment, credential theft, and lateral movement from the ColdFusion host.

Why it matters to the business

A successful attack can give an external attacker control of a ColdFusion server without needing a password or user interaction. Because ColdFusion servers often host business applications and may have access to databases, internal services, uploaded files, and application secrets, compromise can lead to data theft, service disruption, fraud, ransomware staging, or broader network intrusion. The CVSS score is critical and EPSS is high, indicating meaningful likelihood of exploitation even though this vulnerability is not currently listed in CISA KEV and no ransomware-specific KEV association is present.

How an attack unfolds

An attacker first identifies an internet-facing Adobe ColdFusion instance and determines whether it is running an affected update level. The attacker then sends a crafted HTTP request containing malicious serialized data to a ColdFusion endpoint that processes untrusted input. When the vulnerable server deserializes that payload, attacker-controlled object logic is invoked and results in arbitrary code execution. The attacker commonly uses this execution to run operating-system commands, download a second-stage payload, create or modify ColdFusion Markup Language files, deploy a web shell under a web-accessible directory, dump application configuration and credentials, and establish persistence. Follow-on activity may include accessing databases using application credentials, scanning internal systems, exfiltrating files, or using the ColdFusion server as a foothold for broader compromise.

How to fix it

Upgrade Adobe ColdFusion immediately to a fixed or later update level. Based on the affected ranges, ColdFusion 2018 should be updated to Update 19 or later, ColdFusion 2021 to Update 9 or later, and ColdFusion 2023 to Update 3 or later; preferably install the latest available Adobe ColdFusion security update for the deployed major version. ColdFusion 2018 is an older branch and should be migrated to a currently supported release where possible. After patching, restart ColdFusion services and confirm the effective update level from the administrator console or version files. If immediate patching is not possible, restrict external access to ColdFusion administration and application endpoints, place the service behind a WAF or reverse proxy with strict allowlisting, block access to unnecessary CFIDE and administrator paths, disable unused services, limit outbound network access from the ColdFusion host, and run the ColdFusion service with the least privileges required. Mitigations should be treated as temporary because the underlying issue enables remote code execution.

How to confirm the fix worked

Confirm that every ColdFusion instance is no longer running 2018 Update 18 or earlier, 2021 Update 8 or earlier, or 2023 Update 2 or earlier. Validate the installed update level through the ColdFusion Administrator, Adobe update logs, package inventory, file version checks, or configuration-management tooling. Perform an external exposure review to ensure ColdFusion administrative paths and unnecessary CFIDE components are not publicly reachable. Review web server and ColdFusion logs after patching for continued attempts containing serialized payload markers, unusual POST requests, or requests to ColdFusion administrative/API endpoints. Confirm that the ColdFusion service account cannot write to unnecessary web-accessible directories and cannot make unrestricted outbound connections. If exploitation is suspected, do not rely only on version validation; perform forensic review for web shells, unexpected CFML/JSP files, suspicious child processes, and unauthorized configuration changes.

Typical attack path

1. Scan for exposed Adobe ColdFusion services and management or application endpoints.
2. Fingerprint the ColdFusion major version and update level using HTTP responses, exposed files, error pages, or behavioral probes.
3. Send a crafted unauthenticated HTTP request containing malicious serialized data to a vulnerable ColdFusion endpoint.
4. Trigger deserialization on the server, causing attacker-supplied code or gadget-chain behavior to execute under the ColdFusion service account.
5. Execute commands to validate access, such as process listing, environment discovery, or outbound network callbacks.
6. Download tooling or write a web shell into a web-accessible ColdFusion directory.
7. Harvest application secrets, datasource credentials, configuration files, session material, and local system information.
8. Use the compromised server for persistence, data access, internal reconnaissance, lateral movement, or disruptive activity.

How to detect it

To determine whether exploitation already occurred, review web server access logs, ColdFusion logs, reverse proxy logs, WAF events, EDR telemetry, process creation logs, filesystem timelines, and outbound network records. Focus on unauthenticated POST requests to ColdFusion endpoints, especially CFIDE, administrator, adminapi, CFC, and WDDX-related paths, with unusual serialized object content or Java gadget-chain strings. Look for ColdFusion service processes spawning operating-system shells, scripting engines, download utilities, or network tools. On Windows, investigate child processes from coldfusion.exe, cfusion.exe, jrun.exe, java.exe, or the ColdFusion service that launch cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, wscript.exe, cscript.exe, rundll32.exe, or curl.exe. On Linux, investigate ColdFusion Java processes spawning sh, bash, curl, wget, python, perl, nc, or chmod. Review web-accessible directories for newly created or recently modified CFML/JSP web shells, unfamiliar CFC files, encoded payloads, or files with timestamps close to suspicious requests. Check ColdFusion exception, application, server, and update logs for deserialization errors, class-loading errors, WDDX processing errors, stack traces, and unexpected administrator activity. Review outbound connections from the ColdFusion host to unfamiliar IPs, newly seen domains, paste sites, file-sharing services, VPS providers, or command-and-control infrastructure. If available, correlate suspicious HTTP requests with subsequent process execution, file writes, and outbound network callbacks within a short time window.

• <wddxPacket
• </wddxPacket>
• java.lang.ProcessBuilder
• java.lang.Runtime
• Runtime.getRuntime
• getRuntime().exec
• javax.naming.InitialContext
• com.sun.rowset.JdbcRowSetImpl
• org.apache.commons.collections
• org.apache.commons.beanutils
• ysoserial
• /CFIDE/adminapi/
• /CFIDE/administrator/
• /CFIDE/wizards/
• /CFIDE/componentutils/
• /cf_scripts/
• coldfusion-out.log
• coldfusion-error.log
• exception.log
• application.log
• server.log
• cmd.exe /c
• powershell.exe -enc
• powershell -nop
• powershell -w hidden
• certutil.exe -urlcache
• bitsadmin /transfer
• curl -o
• wget http
• bash -c
• /bin/sh -c
• nc -e
• python -c
• perl -e
• .cfm
• .cfc
• .jsp
• cfexecute
• cffile action="write"

What your security team should do

• Prioritize emergency patching of all internet-facing Adobe ColdFusion servers because the flaw is unauthenticated remote code execution with a critical CVSS score and high EPSS likelihood.
• Inventory ColdFusion deployments across production, staging, development, and legacy systems; include hosts behind reverse proxies and load balancers.
• Upgrade to the latest available Adobe ColdFusion security update, with minimum target levels of 2018 Update 19, 2021 Update 9, or 2023 Update 3 depending on branch.
• Restrict public access to ColdFusion Administrator, CFIDE, adminapi, and other management-related paths; require VPN, private network access, or strong access controls.
• Harden the ColdFusion runtime by enforcing least-privilege service accounts, limiting filesystem write permissions, and restricting outbound egress from application servers.
• Search historical web, application, EDR, and proxy logs for suspicious deserialization payloads, unexpected command execution, and web shell creation around and after public disclosure.
• Inspect web roots and ColdFusion directories for recently modified or unfamiliar .cfm, .cfc, .jsp, .class, .jar, .war, .cmd, .bat, .ps1, and archive files.
• Rotate credentials and secrets accessible to ColdFusion if compromise is suspected, including datasource passwords, API keys, service account credentials, and administrator passwords.
• Add SIEM detections for suspicious ColdFusion requests and for ColdFusion spawning shell or scripting interpreters.
• If evidence of exploitation is found, isolate the host, preserve logs and disk artifacts, rebuild from trusted media where appropriate, and conduct broader lateral-movement investigation.