erroneo.us
Search all guides⌘K

Security Digest · Jul 11, 2023 · Vulnerability · Web framework

ColdFusion CVE-2023-29300/38203: Exploited Pre-Auth RCE

Pre-auth WDDX deserialization RCE in ColdFusion 2018/2021/2023, in KEV with ransomware use. Fully fixed by 2018 U19, 2021 U9, 2023 U3. Confirm and hunt.

Published By erroneo.us Security Desk · Updated 3 min read13 sources

Our verdict

Check exposure

Fixed since July 2023, but any ColdFusion server still below 2018 Update 19, 2021 Update 9 or 2023 Update 3 is open to a public, pre-auth RCE that ransomware crews have used; find those servers, upgrade, and hunt for web shells.

Who must act: Anyone with a ColdFusion 2018, 2021 or 2023 server, internal or internet-facing, that has not been updated since mid-2023, or a JEE deployment without Adobe's serial filter flag.

Who can relax: Teams on a current ColdFusion 2025 or 2023 update with the matching JDK, which include these fixes, and organizations that do not run ColdFusion at all.

Affected
ColdFusion 2023 GA (2023.0.0.330468) for CVE-2023-29300; 2023 Update 1 and earlier for CVE-2023-38203
ColdFusion 2021 Update 6 and earlier for CVE-2023-29300; Update 7 and earlier for CVE-2023-38203
ColdFusion 2018 Update 16 and earlier for CVE-2023-29300; Update 17 and earlier for CVE-2023-38203
The follow-on bypass CVE-2023-38204 affects 2023 Update 2, 2021 Update 8, 2018 Update 18 and earlier
Fixed in
ColdFusion 2023 Update 3 (closes the whole chain, including CVE-2023-38204)
ColdFusion 2021 Update 9
ColdFusion 2018 Update 19 (the final 2018 update)
Any later ColdFusion 2023 or 2025 update
CVSS
9.8 (v3.1, vendor)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every ColdFusion server and read its version in ColdFusion Administrator; the third number is the update level (2018.0.19.330149 is 2018 Update 19).
  2. Move to a current ColdFusion 2025 or 2023 update; treat 2023 Update 3, 2021 Update 9 and 2018 Update 19 as the bare minimum for this chain.
  3. Update the bundled JDK to the version in Adobe's support matrix; Adobe says the ColdFusion update alone will not secure the server.
  4. On JEE deployments, set the -Djdk.serialFilter JVM flag from the bulletin in the application server's startup file.
  5. Block /CFIDE/adminapi/ and other administrator paths from the internet and apply Adobe's lockdown guide.
  6. Plan to retire ColdFusion 2018 and 2021, which no longer receive security fixes.

How to check if you are affected or compromised

  • Search web server logs for POST requests to /CFIDE/adminapi/accessmanager.cfc or other .cfc endpoints carrying an argumentCollection parameter.
  • Look for unexpected .cfm or .jsp files under wwwroot/CFIDE, such as the ckeditr.cfm web shell Rapid7 found.
  • Check EDR or process logs for the ColdFusion process spawning powershell.exe, cmd.exe, curl or wget, and for XMRig or other miners.
  • Search DNS and proxy logs for oastify.com and other out-of-band callback domains, and for the Rapid7 IPs 62.233.50.13, 5.182.36.4 and 195.58.48.155.

What happened#

On July 11, 2023, Adobe bulletin APSB23-40 fixed CVE-2023-29300, a critical deserialization flaw (CWE-502, CVSS 3.1 9.8) in ColdFusion that Nicolas Zilio of CrowdStrike reported. Per ProjectDiscovery's analysis, WDDX data sent in the argumentCollection parameter to a component endpoint such as /CFIDE/adminapi/accessmanager.cfc makes the server create an attacker-chosen Java class and call its setters, with no login.

ProjectDiscovery's July 12 exploit, quickly pulled, turned out to be a new bypass: its com.sun.rowset.JdbcRowSetImpl gadget was not on the July 11 denylist. Rapid7 saw attacks from July 13 chaining it with the access-control bypass CVE-2023-29298 to plant web shells. Adobe fixed it out of band on July 14 as CVE-2023-38203 (APSB23-41).

That filter was sidestepped too; Adobe fixed the bypass as CVE-2023-38204 in APSB23-47 on July 19. FortiGuard Labs later saw reverse shells, XMRig miners, the Lucifer DDoS bot and the BillGates/Setag backdoor delivered through these bugs. CISA added CVE-2023-29300 and CVE-2023-38203 to the KEV catalog on January 8, 2024, and marks both as used in ransomware campaigns. It has not named the groups.

Who is affected#

ColdFusion 2018, 2021 and 2023 are affected. The first fixes were 2018 Update 17, 2021 Update 7 and 2023 Update 1. Closing the whole chain needs 2018 Update 19, 2021 Update 9 or 2023 Update 3, or anything later. Adobe warns that applying the update without the matching JDK update "will NOT secure the server". JEE deployments also need the -Djdk.serialFilter JVM flag listed in the bulletins.

2018 Update 19 was the last 2018 update ever (per endoflife.date). ColdFusion 2021 left core support on November 10, 2025, and Adobe says its extended support does not include security patches. Only 2023 and 2025 still get fixes.

Do you really need to act?#

Most teams do not: current 2023 and 2025 updates have included these fixes for years. The risk sits in forgotten servers, such as an old 2018 or 2021 box, an internal app nobody owns, or a JEE install without the serial filter. For those, the danger is real. The bug needs no login, working exploits have been public since July 2023, and CISA links it to ransomware. Treat any server that was below the fixed levels and reachable as possibly compromised, not just unpatched.

What to do now#

  1. Inventory every ColdFusion server and read the version in ColdFusion Administrator; the third number is the update level (2018.0.19.330149 is 2018 Update 19).
  2. Upgrade to a current ColdFusion 2025 or 2023 update. 2023 Update 3, 2021 Update 9 and 2018 Update 19 are only the floor for this chain.
  3. Update the JDK to the version in Adobe's support matrix. On JEE installs, add the bulletin's -Djdk.serialFilter=... flag to the startup file (for example JAVA_OPTS in catalina.sh).
  4. Block /CFIDE/adminapi/ and other administrator paths from the internet at the proxy or WAF, and apply Adobe's lockdown guide.

How to tell if you were hit#

Search web server logs (IIS, Apache or the ColdFusion connector) for POST requests to /CFIDE/adminapi/accessmanager.cfc or other .cfc endpoints carrying argumentCollection. Look for unfamiliar .cfm or .jsp files under wwwroot/CFIDE. Rapid7 found a shell named ckeditr.cfm there. Check process telemetry for the ColdFusion service spawning powershell.exe, cmd.exe, curl or wget, and for crypto miners. Rapid7's July 2023 indicators include callbacks to oastify.com and the IPs 62.233.50.13, 5.182.36.4 and 195.58.48.155. The IPs are old, so a miss proves little. If you find a shell, rebuild the server and rotate the datasource and admin credentials it stores.

Timeline#

  • — Adobe APSB23-40 fixes CVE-2023-29300 (2018 U17, 2021 U7, 2023 U1).
  • — Rapid7 observes exploitation chaining CVE-2023-29298 with the new deserialization bypass.
  • — Adobe APSB23-41 fixes CVE-2023-38203 out of band.
  • — Adobe APSB23-47 fixes the further bypass CVE-2023-38204 (2018 U19, 2021 U9, 2023 U3).
  • — CISA adds CVE-2023-29300 and CVE-2023-38203 to KEV (due January 29, 2024).

Vulnerability records

  • CVE-2023-29300 · KEV 2024-01-08 · Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data…
  • CVE-2023-38203 · KEV 2024-01-08 · Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Adobe — APSB23-40: Security updates available for Adobe ColdFusion helpx.adobe.com
  2. Adobe — APSB23-41: Security updates available for Adobe ColdFusion helpx.adobe.com
  3. Adobe — APSB23-47: Security updates available for Adobe ColdFusion helpx.adobe.com
  4. CVE record — CVE-2023-29300 cve.org
  5. CVE record — CVE-2023-38203 cve.org
  6. NVD — CVE-2023-29300 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2023-29300 cisa.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2023-38203 cisa.gov
  9. ProjectDiscovery — Adobe ColdFusion pre-auth RCE (CVE-2023-29300, CVE-2023-38203, CVE-2023-38204) projectdiscovery.io
  10. Rapid7 — Active exploitation of multiple Adobe ColdFusion vulnerabilities rapid7.com
  11. Fortinet FortiGuard Labs — Multiple threats target Adobe ColdFusion vulnerabilities fortinet.com
  12. Adobe ColdFusion blog — Planning ahead: ColdFusion 2021 support ending soon coldfusion.adobe.com
  13. endoflife.date — Adobe ColdFusion endoflife.date