CVE-2023-26347
📋 TL;DR
This vulnerability allows unauthenticated attackers to bypass security controls and access ColdFusion administration endpoints (CFM/CFC files). Adobe ColdFusion versions 2023.5 and earlier, and 2021.11 and earlier are affected. Exploitation requires no user interaction.
💻 Affected Systems
- Adobe ColdFusion
📦 What is this software?
Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ColdFusion server allowing administrative access, potential data theft, and further server exploitation.
Likely Case
Unauthorized access to administrative interfaces leading to configuration changes, data exposure, or privilege escalation.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to administration endpoints.
🎯 Exploit Status
Vulnerability allows direct access to administration endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ColdFusion 2023.6, ColdFusion 2021.12
Vendor Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
Restart Required: Yes
Instructions:
1. Download ColdFusion 2023.6 or 2021.12 from Adobe website. 2. Apply update using ColdFusion update installer. 3. Restart ColdFusion services.
🔧 Temporary Workarounds
Restrict access to administration endpoints
allUse web server configuration to block access to /CFIDE/administrator and other admin endpoints
# Apache: RewriteRule ^/CFIDE/administrator.* - [F]
# IIS: Add URL rewrite rule to block /CFIDE/administrator
🧯 If You Can't Patch
- Implement strict network access controls to limit ColdFusion server exposure
- Monitor access logs for unauthorized attempts to access administration endpoints
🔍 How to Verify
Check if Vulnerable:
Check ColdFusion version in administrator interface or via cfusion/lib/version.txtCheck Version:
# Windows: type "C:\ColdFusion\cfusion\lib\version.txt"
# Linux: cat /opt/coldfusion/cfusion/lib/version.txtVerify Fix Applied:
Verify version is 2023.6 or higher, or 2021.12 or higher📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /CFIDE/administrator endpoints
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual traffic patterns to ColdFusion administration ports
- External IPs accessing admin endpoints
SIEM Query:
source="coldfusion.log" AND (uri_path="/CFIDE/administrator" OR uri_path="/CFIDE/adminapi") AND http_status=200