CVE-2024-20767

What it actually does

CVE-2024-20767 is an unauthenticated improper access control flaw in Adobe ColdFusion 2023 Update 6, ColdFusion 2021 Update 12, and earlier supported update levels. A remote attacker can bypass intended security checks to read arbitrary files from the server filesystem and, under vulnerable conditions, write files as the ColdFusion application service account. The primary technical risk is disclosure of sensitive local files such as application source code, configuration files, credentials, encryption material, database connection details, and ColdFusion administrative configuration. The file-write capability can also enable attacker persistence, application tampering, or web-accessible script placement if writable paths are reachable.

Why it matters to the business

Successful exploitation can expose application secrets, customer or business data stored on the server, database credentials, and internal configuration details that enable broader compromise. If attackers can write files, they may alter application behavior or establish persistent access, creating outage, incident response, legal, and data-breach risks. This issue is high urgency because it is listed in CISA KEV, has active in-the-wild exploitation, has a very high EPSS likelihood, and the KEV remediation deadline of 2025-01-06 has passed. Internet-facing ColdFusion servers should be treated as priority assets for emergency validation, patching, and compromise assessment.

How an attack unfolds

An attacker first identifies an exposed Adobe ColdFusion instance and fingerprints its version or update level. If the server is running ColdFusion 2023 Update 6, ColdFusion 2021 Update 12, or an earlier vulnerable update, the attacker sends crafted unauthenticated HTTP requests that bypass ColdFusion access controls and cause the application to access attacker-specified filesystem paths. The attacker typically attempts to read high-value files such as ColdFusion configuration, application configuration, credential stores, source files, and operating-system files to obtain usernames, passwords, keys, or environmental details. If file write is achievable in the target configuration, the attacker may write a file into a web-accessible or application-executed directory, modify configuration, or stage tooling for persistence. Post-exploitation activity commonly includes credential reuse, database access, additional reconnaissance, log cleanup attempts, and deployment of web shells or other remote access mechanisms. Because this vulnerability is in KEV and actively exploited, opportunistic internet scanning and exploitation should be expected even without a named threat group attribution.

How to fix it

Upgrade Adobe ColdFusion immediately to a fixed update level: ColdFusion 2023 Update 7 or later, and ColdFusion 2021 Update 13 or later. If newer cumulative updates are available from Adobe, deploy the latest supported update rather than only the minimum fixed update. Restrict public access to ColdFusion Administrator and CFIDE administrative paths, place administrative interfaces behind VPN or strong network allowlists, and require strong authentication. Run the ColdFusion service with least-privilege filesystem permissions so it cannot read unnecessary sensitive files or write to web roots except where explicitly required. Review and rotate secrets that may have been readable from the server, including database passwords, API keys, LDAP credentials, keystore passwords, and application encryption keys. Remove unnecessary sample applications, unused CFIDE components, old backups, and writable deployment artifacts from web-accessible directories. The supplied package fixed-version list references AlmaLinux rsyslog-related packages rather than Adobe ColdFusion packages; use Adobe ColdFusion update levels as authoritative for this CVE and separately patch operating-system packages according to their own advisories.

How to confirm the fix worked

Confirm the installed ColdFusion update level from the ColdFusion Administrator, Adobe update logs, or filesystem version metadata, and verify it is ColdFusion 2023 Update 7 or later, or ColdFusion 2021 Update 13 or later. From the host, review ColdFusion update installation logs for successful completion and no rollback. From an external perspective, verify that ColdFusion Administrator and other administrative endpoints are not publicly reachable except from approved networks. Run an authenticated vulnerability scan or configuration assessment that checks the ColdFusion build/update number rather than relying only on banner detection. Validate filesystem permissions by confirming the ColdFusion service account cannot write to arbitrary web-accessible directories and cannot read unrelated sensitive operating-system files. If the host was internet-facing before remediation, perform compromise assessment rather than treating patching alone as sufficient.

Typical attack path

1. Scan the internet or internal address space for exposed Adobe ColdFusion services, especially CFIDE or ColdFusion Administrator paths.
2. Fingerprint the ColdFusion major version and update level through HTTP responses, accessible files, error pages, or behavioral probes.
3. Send crafted unauthenticated requests that bypass access control and reference sensitive filesystem paths.
4. Read ColdFusion, application, operating-system, or web-server configuration files to collect credentials and secrets.
5. Use recovered credentials to access databases, administrative interfaces, source repositories, or adjacent systems.
6. If file write is possible, write or modify files under paths accessible to the ColdFusion runtime, potentially including web-accessible CFM/JSP content.
7. Establish persistence, execute follow-on reconnaissance, exfiltrate data, and attempt to remove or reduce forensic evidence.

How to detect it

Review HTTP access logs from the web server, reverse proxy, WAF, and ColdFusion connector for unauthenticated requests containing path traversal, encoded traversal, references to sensitive ColdFusion configuration files, or attempts to retrieve operating-system files. Collect and examine ColdFusion logs including application.log, exception.log, coldfusion-out.log, coldfusion-error.log, server.log, security.log, update logs, and connector logs for unusual file access errors, unexpected template execution, or requests to administrative paths from untrusted IP addresses. On the host, perform filesystem timeline analysis for newly created or modified files under ColdFusion web roots, CFIDE directories, application deployment directories, temporary directories, and upload directories, especially .cfm, .cfc, .jsp, .war, .jar, .class, .txt, .zip, and disguised image files. Search for access to common sensitive files such as neo-security.xml, neo-datasource.xml, neo-runtime.xml, password.properties, seed.properties, jvm.config, web.xml, application.cfc, application.cfm, /etc/passwd, /etc/shadow, win.ini, and Windows SAM/SYSTEM paths. Review process execution telemetry for unexpected child processes spawned by the ColdFusion service account, including shell, PowerShell, curl, wget, certutil, cmd, bash, sh, python, perl, or encoded command execution. Check database, LDAP, mail, cloud, and API authentication logs for credential use shortly after suspicious ColdFusion file-read activity. Treat successful file-write indicators, web-shell artifacts, or suspicious ColdFusion-spawned processes as evidence of likely compromise and preserve forensic artifacts before remediation.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /CFIDE/administrator/
• /CFIDE/adminapi/
• /CFIDE/componentutils/
• /CFIDE/wizards/
• neo-security.xml
• neo-datasource.xml
• neo-runtime.xml
• neo-cron.xml
• neo-mail.xml
• neo-debug.xml
• password.properties
• seed.properties
• jvm.config
• WEB-INF/web.xml
• Application.cfc
• Application.cfm
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\config\\SAM
• C:\\Windows\\System32\\config\\SYSTEM
• cfusion/logs/application.log
• cfusion/logs/exception.log
• cfusion/logs/coldfusion-out.log
• cfusion/logs/coldfusion-error.log
• cfusion/logs/server.log
• cfusion/logs/security.log
• cfusion/wwwroot/*.cfm
• cfusion/wwwroot/*.cfc
• cfusion/wwwroot/*.jsp
• ColdFusion2023/cfusion/wwwroot
• ColdFusion2021/cfusion/wwwroot
• cmd.exe /c
• powershell -enc
• powershell.exe -EncodedCommand
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• certutil -urlcache

What your security team should do

• Patch or upgrade all Adobe ColdFusion 2023 and 2021 servers to fixed or current supported update levels immediately, prioritizing internet-facing systems.
• Because this vulnerability is in CISA KEV with active exploitation and a passed due date, open an incident-style review for any exposed vulnerable servers that were reachable before patching.
• Restrict ColdFusion Administrator, CFIDE administrative paths, and management ports to trusted administrative networks only.
• Hunt for suspicious arbitrary file-read attempts, path traversal patterns, access to ColdFusion configuration files, and unexpected file creation in web-accessible directories.
• Review ColdFusion service account permissions and remove broad read/write access that is not required for application operation.
• Rotate credentials and secrets stored on or accessible from vulnerable ColdFusion servers, especially database, LDAP, mail, API, and keystore credentials.
• Search for new or modified .cfm, .cfc, .jsp, .war, .class, and archive files under ColdFusion web roots and application directories.
• Correlate web access logs with ColdFusion application, exception, security, and runtime logs around suspicious requests and file modifications.
• Preserve relevant logs and filesystem timestamps before rebuilding or cleaning systems if exploitation is suspected.
• Monitor for follow-on use of credentials originally stored on ColdFusion hosts, including unusual database logins or administrative access from new source addresses.