CVE-2023-44350

What it actually does

CVE-2023-44350 is an unauthenticated deserialization vulnerability in Adobe ColdFusion. A remote attacker can send crafted serialized data to a vulnerable ColdFusion service or endpoint and cause the server-side Java runtime to instantiate attacker-controlled objects. If a usable gadget chain is present, this can lead to arbitrary code execution with the privileges of the ColdFusion service account. Because the CVSS vector is network-accessible, low-complexity, unauthenticated, and requires no user interaction, a successful exploit can provide full confidentiality, integrity, and availability impact on the application server.

Why it matters to the business

A successful compromise can allow an attacker to take over ColdFusion application servers, steal application data and credentials, modify hosted applications, deploy web shells or malware, pivot into connected systems, and interrupt business services. The EPSS score is high, indicating meaningful probability of exploitation activity even though this CVE is not currently listed in CISA KEV. ColdFusion systems are often internet-facing and business-critical, so exposed unpatched instances should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Adobe ColdFusion server running an affected release: ColdFusion 2023 Update 5 or earlier, or ColdFusion 2021 Update 11 or earlier. The attacker then sends a malicious request containing crafted serialized data to functionality that performs unsafe deserialization. ColdFusion processes the data inside the Java application runtime, triggering object creation and execution flow controlled by the attacker. If exploitation succeeds, the attacker gains code execution as the ColdFusion service user. From there, common post-exploitation actions include running operating system commands, writing a JSP/CFM web shell into a web-accessible directory, dumping configuration files, harvesting database credentials, staging additional tooling, and using the compromised server for persistence or lateral movement.

How to fix it

Upgrade Adobe ColdFusion to a fixed or later release. Systems running ColdFusion 2023 Update 5 or earlier should be upgraded to ColdFusion 2023 Update 6 or later. Systems running ColdFusion 2021 Update 11 or earlier should be upgraded to ColdFusion 2021 Update 12 or later. Where possible, upgrade to the latest available supported ColdFusion update rather than only the first fixed version. After patching, restart ColdFusion services and verify the active update level. Reduce exposure by restricting access to ColdFusion Administrator and management interfaces, placing ColdFusion behind a reverse proxy or WAF where appropriate, enforcing least privilege on the ColdFusion service account, removing unused components, and applying Adobe ColdFusion lockdown guidance. If immediate patching is not possible, limit network access to trusted sources only and monitor aggressively for suspicious requests and child process creation from the ColdFusion Java process; these are risk-reduction steps, not substitutes for patching.

How to confirm the fix worked

Confirm exposure by inventorying all Adobe ColdFusion installations and checking the installed major version and update level through the ColdFusion Administrator, update logs, package metadata, or server file inventory. A fixed posture requires ColdFusion 2023 Update 6 or later, ColdFusion 2021 Update 12 or later, or a newer supported release. Validate that the ColdFusion service was restarted after the update and that the runtime is no longer reporting an affected update level. From an external perspective, verify that ColdFusion Administrator and other management paths are not publicly reachable unless explicitly required and protected. Review WAF, reverse proxy, web server, and ColdFusion logs for exploit attempts before and after remediation. If compromise is suspected, do not rely only on version validation; perform forensic review for web shells, unusual child processes, modified application files, suspicious scheduled tasks, and credential access artifacts.

Typical attack path

1. Scan for exposed Adobe ColdFusion servers and fingerprint the major version and update level.
2. Confirm the target is running ColdFusion 2023 Update 5 or earlier, or ColdFusion 2021 Update 11 or earlier.
3. Send a crafted unauthenticated request containing malicious serialized data to a vulnerable ColdFusion component or endpoint.
4. Trigger deserialization inside the ColdFusion Java runtime and execute attacker-controlled code.
5. Run reconnaissance commands under the ColdFusion service account to identify permissions, paths, users, and connected services.
6. Write a web shell or secondary payload into a ColdFusion-accessible web directory.
7. Harvest application configuration, database credentials, API keys, or session material.
8. Maintain access, pivot to other systems, or disrupt the application server.

How to detect it

To determine whether exploitation already occurred, review ColdFusion application logs, exception logs, update logs, runtime logs, web server access logs, reverse proxy logs, WAF alerts, EDR telemetry, file integrity monitoring, and operating system process creation logs. Focus on unauthenticated requests to ColdFusion endpoints followed by Java errors, deserialization-related exceptions, abnormal HTTP 500 responses, or immediate process creation from the ColdFusion Java runtime. On Windows, examine Security Event ID 4688, Sysmon Event ID 1, PowerShell logs, scheduled task creation, and service creation events where the parent process is the ColdFusion Java process. On Linux, review auditd, shell history where available, cron changes, systemd unit changes, and process accounting for commands spawned by the ColdFusion runtime. Inspect ColdFusion web roots and CFIDE-related directories for recently created or modified .cfm, .cfc, .jsp, .jspx, .war, or archive files. Look for outbound network connections from the ColdFusion process to unfamiliar IP addresses, especially to uncommon ports or command-and-control-like destinations. If suspicious activity is found, preserve logs and disk artifacts before cleanup, isolate the server, collect volatile process/network information, and rotate application and database credentials after containment.

• coldfusion-out.log
• exception.log
• application.log
• server.log
• cfusion/runtime/logs
• cfusion/wwwroot/CFIDE
• java.io.ObjectInputStream
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• javax.naming.InitialContext
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• wscript.exe
• cscript.exe
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• nc -e
• ncat -e
• .cfm.jsp
• .jsp;.cfm
• new Scheduled Task
• schtasks /create
• crontab -e
• /etc/cron.d/
• /tmp/.
• /var/tmp/.
• C:\ColdFusion2023\cfusion\wwwroot\
• C:\ColdFusion2021\cfusion\wwwroot\
• C:\ColdFusion2023\cfusion\runtime\logs\
• C:\ColdFusion2021\cfusion\runtime\logs\
• /opt/ColdFusion2023/cfusion/wwwroot/
• /opt/ColdFusion2021/cfusion/wwwroot/
• /opt/ColdFusion2023/cfusion/runtime/logs/
• /opt/ColdFusion2021/cfusion/runtime/logs/

What your security team should do

• Identify all Adobe ColdFusion servers, including development, staging, disaster recovery, and legacy systems.
• Prioritize patching internet-facing ColdFusion servers to ColdFusion 2023 Update 6 or later, ColdFusion 2021 Update 12 or later, or the latest supported update.
• Because the EPSS score is high and exploitation requires no authentication or user interaction, treat exposed vulnerable systems as urgent even though the CVE is not currently in CISA KEV.
• Restrict external access to ColdFusion Administrator and management interfaces; allow only trusted administrative networks or VPN access.
• Hunt for prior compromise before and after patching, focusing on suspicious ColdFusion requests, Java-spawned operating system commands, new CFM/JSP files, and unexpected outbound connections.
• Review ColdFusion service account privileges and reduce local administrator/root permissions wherever possible.
• Rotate credentials stored on or used by ColdFusion applications if there are signs of exploitation or unexplained file/process activity.
• Add detections for command execution by the ColdFusion Java process and unexpected file writes under ColdFusion web roots.
• Back up critical application files and configuration before remediation, then compare post-patch file integrity against known-good baselines.