CVE-2023-38204

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability allows remote attackers to execute arbitrary code on Adobe ColdFusion servers without authentication or user interaction. It affects all ColdFusion installations running vulnerable versions, potentially compromising entire servers and their data.

💻 Affected Systems

Products:

Adobe ColdFusion

Versions: 2018 Update 18 and earlier, 2021 Update 8 and earlier, 2023 Update 2 and earlier

Operating Systems: All supported platforms

Default Config Vulnerable: ⚠️ Yes

Notes: All ColdFusion installations with vulnerable versions are affected regardless of configuration.

📦 What is this software?

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

Coldfusion by Adobe

Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...

Learn more about Coldfusion →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server takeover with full administrative access, data exfiltration, ransomware deployment, and lateral movement to other systems.

🟠

Likely Case

Remote code execution leading to web shell installation, credential theft, and persistence mechanisms on compromised servers.

🟢

If Mitigated

Limited impact if proper network segmentation, application firewalls, and monitoring prevent exploitation attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit code is available, making this easily weaponizable by attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: ColdFusion 2018 Update 19, 2021 Update 9, 2023 Update 3

Vendor Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html

Restart Required: Yes

Instructions:

1. Download the appropriate update from Adobe's website. 2. Backup your ColdFusion installation. 3. Apply the update following Adobe's installation guide. 4. Restart ColdFusion services.

🔧 Temporary Workarounds

Network Access Control

all

Restrict access to ColdFusion administration and application ports to trusted IP addresses only.

Use firewall rules to limit access to ColdFusion ports (typically 8500, 80, 443)

Web Application Firewall

all

Deploy a WAF with rules to detect and block deserialization attacks.

Configure WAF rules for ColdFusion deserialization vulnerabilities

🧯 If You Can't Patch

Isolate ColdFusion servers in a separate network segment with strict access controls
Implement comprehensive monitoring and alerting for suspicious ColdFusion activity

🔍 How to Verify

Check if Vulnerable:

Check ColdFusion version in ColdFusion Administrator or via cfadmin/api endpoint

Check Version:

On Windows: cfusion\bin\cfadmin.exe -v | On Linux: /opt/coldfusion/cfusion/bin/cfadmin -v

Verify Fix Applied:

Verify version is updated to 2018u19, 2021u9, or 2023u3 or later

📡 Detection & Monitoring

Log Indicators:

Unusual Java deserialization errors in ColdFusion logs
Suspicious POST requests to ColdFusion endpoints
Unexpected process creation from ColdFusion

Network Indicators:

Unusual outbound connections from ColdFusion servers
Traffic to known malicious IPs from ColdFusion

SIEM Query:

source="coldfusion.log" AND ("deserialization" OR "java.io" OR suspicious POST request)

📊 Metadata

CVE ID: CVE-2023-38204

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: September 14, 2023

Last Updated: November 21, 2024

🔗 References

https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html Vendor Advisory
https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html Vendor Advisory