CVE-2023-44352

What it actually does

This is a reflected cross-site scripting vulnerability in Adobe ColdFusion 2023 Update 5 and earlier and ColdFusion 2021 Update 11 and earlier. A vulnerable ColdFusion page reflects attacker-controlled input into an HTTP response without sufficient output encoding or sanitization. Because exploitation requires a victim to open a crafted URL, the attacker does not need authentication but does need user interaction. Successful exploitation causes attacker-supplied JavaScript to execute in the victim’s browser in the security context of the affected ColdFusion site, potentially allowing theft of page data, session-related tokens accessible to JavaScript, unauthorized actions as the victim, phishing overlays, or redirection to attacker-controlled infrastructure. The CVSS scope change reflects that the impact crosses from the vulnerable server-side application into the victim browser context.

Why it matters to the business

Organizations running affected Adobe ColdFusion versions may be exposed to account compromise, administrative session abuse, credential phishing, and unauthorized actions performed through a trusted ColdFusion interface. The risk is elevated because exploit maturity is weaponized and the EPSS score is high, indicating meaningful likelihood of exploitation activity. While this flaw does not directly provide server-side code execution by itself, exploitation against privileged users can materially increase operational risk, especially where ColdFusion administration or sensitive internal applications are reachable from user browsers.

How an attack unfolds

An attacker identifies an exposed Adobe ColdFusion instance running an affected release and determines a vulnerable page or parameter that reflects input into the response. The attacker crafts a URL containing malicious JavaScript, often URL-encoded to bypass simple filters and to make the link less obvious. The attacker then delivers the link through phishing, chat, ticket comments, email, compromised web content, or another lure. When a victim who has access to the ColdFusion application opens the link, the vulnerable page returns the attacker-controlled content and the browser executes it as if it originated from the trusted ColdFusion site. The script can read non-HttpOnly data available to the page, manipulate the page, submit requests using the victim’s authenticated browser session, redirect the user, or present convincing credential prompts. If the victim is an administrator or privileged application user, the attacker may use the browser-executed script to change settings, create persistence through legitimate application features, or pivot to further compromise.

How to fix it

Upgrade Adobe ColdFusion to a fixed release. For the affected branches described, update ColdFusion 2023 from Update 5 or earlier to ColdFusion 2023 Update 6 or later, and update ColdFusion 2021 from Update 11 or earlier to ColdFusion 2021 Update 12 or later, following Adobe’s official security bulletin and cumulative update guidance. If immediate patching is not possible, restrict access to ColdFusion administrative and sensitive application interfaces, require VPN or strong identity-aware access controls, reduce exposure of CFIDE and administrative paths, enforce least privilege for administrative users, and monitor for suspicious reflected-XSS payloads in request URLs. Additional hardening should include HttpOnly and SameSite session cookies where compatible, a restrictive Content Security Policy to reduce script execution impact, output encoding in custom ColdFusion applications, and user-awareness controls for phishing links.

How to confirm the fix worked

Confirm the installed ColdFusion update level from the ColdFusion Administrator, command-line inventory, package-management records, or Adobe update logs. Verify that ColdFusion 2023 is on Update 6 or later, or ColdFusion 2021 is on Update 12 or later. Review internet-facing asset inventories and vulnerability scan results to ensure no exposed instance remains on ColdFusion 2023 Update 5 or earlier or ColdFusion 2021 Update 11 or earlier. After patching, perform an authenticated and unauthenticated web scan focused on reflected XSS patterns against ColdFusion pages, confirming that injected special characters are safely encoded and not executed. Validate compensating controls by confirming administrative paths are not publicly reachable, session cookies use secure attributes where feasible, and web application firewall or reverse-proxy rules log and block obvious script-injection attempts.

Typical attack path

1. Discover an internet-facing or internally reachable Adobe ColdFusion deployment.
2. Fingerprint the ColdFusion version or infer exposure based on patch level and accessible ColdFusion pages.
3. Identify or reuse a weaponized reflected XSS URL targeting a vulnerable ColdFusion page or parameter.
4. Encode the JavaScript payload in the URL and prepare a phishing or social-engineering lure.
5. Convince a user with access to the ColdFusion application to open the crafted URL.
6. Execute JavaScript in the victim’s browser under the trusted ColdFusion site origin.
7. Steal accessible tokens or page data, perform actions as the victim, display phishing content, or redirect the victim to attacker-controlled infrastructure.
8. If the victim has elevated privileges, abuse the session to make configuration or application changes and continue the intrusion.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from ColdFusion, upstream web servers, reverse proxies, WAFs, secure web gateways, and load balancers for requests to ColdFusion pages containing script-like content in query strings or form parameters. Focus on URL-encoded payloads such as encoded angle brackets, script tags, JavaScript URI schemes, inline event handlers, iframe/object tags, document.cookie access, fetch/XMLHttpRequest calls, or redirects to unfamiliar domains. Correlate suspicious requests with user-agent, source IP, referrer, authenticated user, and subsequent application actions by the same victim session. Browser and EDR telemetry can show suspicious script-driven navigation, clipboard access, credential prompt overlays, or connections to unfamiliar domains immediately after visiting a ColdFusion URL. Review ColdFusion Administrator logs and application audit logs for changes following suspicious requests, including new users, role changes, scheduled tasks, data source changes, mappings, debugging changes, or file/application modifications. Because reflected XSS often leaves limited server-side evidence beyond the crafted URL request, correlation across web logs, proxy logs, WAF alerts, authentication logs, and endpoint/browser telemetry is important.

• %3Cscript
• %3C%2Fscript%3E
• <script
• </script>
• javascript:
• %6A%61%76%61%73%63%72%69%70%74%3A
• onerror=
• %6F%6E%65%72%72%6F%72%3D
• onload=
• %6F%6E%6C%6F%61%64%3D
• onclick=
• %6F%6E%63%6C%69%63%6B%3D
• document.cookie
• %64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65
• document.domain
• window.location
• %77%69%6E%64%6F%77%2E%6C%6F%63%61%74%69%6F%6E
• eval(
• %65%76%61%6C%28
• alert(
• %61%6C%65%72%74%28
• fetch(
• XMLHttpRequest
• %58%4D%4C%48%74%74%70%52%65%71%75%65%73%74
• <iframe
• %3Ciframe
• <img%20src=x%20onerror=
• %3Cimg%20src%3Dx%20onerror%3D
• /CFIDE/administrator/

What your security team should do

• Prioritize patching all Adobe ColdFusion instances because exploit maturity is weaponized and EPSS is high.
• Upgrade to ColdFusion 2023 Update 6 or later, or ColdFusion 2021 Update 12 or later, and verify the update was applied successfully.
• Inventory all internet-facing and internally reachable ColdFusion servers, including development, staging, disaster recovery, and legacy systems.
• Restrict access to ColdFusion Administrator and sensitive application paths to trusted networks or identity-aware access controls.
• Search web, proxy, WAF, EDR, and browser telemetry for reflected-XSS payloads targeting ColdFusion URLs, especially requests containing encoded script tags, JavaScript schemes, or event-handler attributes.
• Review recent privileged ColdFusion user activity for unusual configuration changes, account creation, application changes, or administrative actions following suspicious URL requests.
• Deploy or tune WAF and reverse-proxy detections for script-injection payloads in query strings and POST bodies, while treating this as a temporary mitigation rather than a substitute for patching.
• Harden session cookies with Secure, HttpOnly, and SameSite attributes where compatible, and evaluate Content Security Policy protections to reduce XSS impact.
• Brief help desk, administrators, and developers that suspicious ColdFusion links may be used for phishing or session abuse, particularly against privileged users.