Adobe ColdFusion (versions prior to ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10)
ColdFusion is Adobe's web application server platform, used by organisations to build and run database-driven websites and internal business applications.
Root Cause
The server fails to validate the type of file being uploaded. Think of it as a secured door with a sign saying "no weapons," but no one actually checking bags. Any file gets through, including ones designed to execute on the server.
Attack Vector
An attacker sends a crafted HTTP request containing a malicious file to a ColdFusion upload endpoint. Because the server performs no type-checking, the file is accepted and stored. The attacker then triggers its execution, gaining full control of the underlying server. No authentication is required.
Detection Notes
Review web server logs for unexpected file uploads to ColdFusion endpoints. Look for newly created files with executable extensions in upload directories. Monitor for unusual outbound connections from the ColdFusion server process.
Recommended Actions
- Update ColdFusion 2023 to Update 21 and ColdFusion 2025 to Update 10 immediately.
- Restrict public access to file upload endpoints at the network or firewall level.
- Review server logs for signs of recent exploitation before patching.