.svg)
.svg)
The Blue Report 2024
Get a comprehensive analysis of over 136 million cyber attacks and understand the state of threat exposure management.
On December 5, 2023, The Cybersecurity and Infrastructure Security Agency (CISA) released an advisory on actively exploited Adobe ColdFusion CVE-2023-26360 vulnerability [1]. The vulnerability allows adversaries to gain initial access to public-facing Adobe ColdFusion web servers. CVE-2023-26360 has a CVSS score of 9.8 (Critical) and is actively being exploited by cyber threat actors.
In this blog, we explained the Adobe ColdFusion CVE-2023-26360 vulnerability and how organizations can defend against CVE-2023-26360 attacks.
Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform
Adobe ColdFusion CVE-2023-26360 Vulnerability Explained
Adobe ColdFusion is a commercial web application development platform that is used to build web applications and services. The platform uses a proprietary language called ColdFusion Markup Language (CFML) to create dynamic and interactive web applications. The application itself is built using Java.
In March 2023, Adobe disclosed a vulnerability affecting Adobe ColdFusion 20218 and 2021. When exploited, the CVE-2023-26360 vulnerability results in arbitrary code execution, and it does not require user interaction. The vulnerability stems from improper access control and has a CVSS score of 9.8 (Critical).
The CVE-2023-26360 vulnerability affects the Adobe products given below.
|
Product Name |
Fixed Versions |
|
Adobe ColdFusion 2021 |
Update 6 and later |
|
Adobe ColdFusion 2018 |
Update 16 and later |
|
Adobe ColdFusion 2016 |
End-of-Life, not supported |
|
Adobe ColdFusion 11 |
End-of-Life, not supported |
In their advisory, CISA confirmed that threat actors exploited the CVE-2023-26360 in two incidents and gained initial access to a Federal Civilian Executive Branch (FCEB) agency. Since proof-of-concept exploits are publicly available, organizations are advised to patch their vulnerable Adobe ColdFusion servers as soon as possible.
How Adobe CVE-2023-26360 Exploit Works?
At its core, CVE-2023-26360 is an improper access control vulnerability caused by deserializing untrusted data without proper validation. When an attacker crafts a malicious HTTP request with “_cfclient=true” in the URL, the Adobe ColdFusion server invokes the “convertToTemplateProxy” function and deserializes the malicious JSON input provided by the attacker. Adversaries use this method for different purposes, such as arbitrary code execution, arbitrary file read, and remote code execution.
|
//Attacker-crafted POST request POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=foo^&_cfclient=true HTTP/1.1 _variables%3D%7B%22_metadata%22%3A%7B%22classname%22%3A%22%5C..%5Cruntime%5Cwork%5CCatalina%5Clocalhost%5Ctmp%5Chax.tmp%22%7D%2C%22_variables%22%3A%7B%7D%7D |
Adobe ColdFusion CVE-2023-26360 Vulnerability Exploit Example
In their advisory, CISA mentioned that threat actors were able to upload a webshell and a remote access trojan (RAT) to the victim's server to establish persistence.
|
Uploaded Files |
Hash (SHA-1) |
|
ee.exe |
b6818d2d5cbd902ce23461f24fc47e24937250e6 |
|
edge.exe |
75a8ceded496269e9877c2d55f6ce13551d93ff4 |
|
fscan.exe |
be332b6e2e2ed9e1e57d8aafa0c00aa77d4b8656 |
|
RC.exe |
9126b8320d18a52b1315d5ada08e1c380d18806b |
How Picus Helps Simulate Adobe ColdFusion CVE-2023-26360 Attacks?
We also strongly suggest simulating the Adobe ColdFusion CVE-2023-26360 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as Follina, Citrix Bleed, and Looney Tunables, within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for Adobe ColdFusion CVE-2023-26360 vulnerability exploitation attacks:
|
Threat ID |
Threat Name |
Attack Module |
|
95963 |
ColdFusion Web Attack Campaign |
Web Application |
Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Adobe ColdFusion CVE-2023-26360 vulnerability and other vulnerability exploitation attacks in preventive security controls. Currently, Picus Labs validated the following signatures for Adobe ColdFusion CVE-2023-26360 vulnerability:
|
Security Control |
Signature ID |
Signature Name |
|
Checkpoint NGFW |
tcp_block_retrans_err_enable |
Invalid segment retransmission. Packet dropped. Please refer to sk172266. |
|
Fortigate IPS |
52899 |
Adobe.ColdFusion.ToTemplateProxy.Insecure.Deserialization |
|
Fortiweb |
060150002 |
Generic Attacks(Extended) |
|
Imperva SecureSphere |
CVE-2023-26360: Adobe Coldfusion Improper Access Control RCE |
|
|
Palo Alto |
93796 |
Adobe Insecure Deserialization Vulnerability |
|
Trend Micro TippingPoint |
42650 |
HTTP: Adobe ColdFusion convertToTemplateProxy Insecure Deserialization Vulnerability |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Complete Security Validation Platform.
READ MORE
References
[1] “Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers,” Cybersecurity and Infrastructure Security Agency CISA. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a. [Accessed: Dec. 06, 2023]
