Adobe ColdFusion (versions prior to 2025.0.12 and 2023.0.23)
ColdFusion is Adobe's web application server platform, used by developers to build and host database-driven websites and internal business applications.
Root Cause
The application fails to sanitise user-supplied input before passing it to underlying operating system functions. An attacker can craft a request containing shell commands that the server interprets and executes with its own privileges, bypassing application-layer controls entirely.
Attack Vector
An attacker sends a malicious request to an exposed ColdFusion endpoint, embedding OS commands inside a parameter the server processes unsafely. The server executes those commands directly, potentially allowing the attacker to install malware, create new administrative accounts, or move laterally (pivot from one compromised system to reach other machines on the same network) through internal infrastructure.
Detection Notes
Look for unusual child processes spawned from the ColdFusion application server process (e.g. cmd.exe or /bin/sh). Review web server access logs for malformed or unexpectedly long parameter strings in POST requests. Monitor for new user accounts or scheduled tasks created around the time of any suspicious ColdFusion traffic.
Recommended Actions
- Update ColdFusion to version 2025.0.12 or 2023.0.23 immediately.
- Restrict external access to ColdFusion admin and API endpoints at the firewall or reverse proxy level.
- Enable application-level logging and alert on unexpected process spawning from the ColdFusion service account.