Adobe Rushes Out Emergency Patch for ColdFusion Zero-Day Exploited in Attacks

July 19, 2023

Adobe has issued an emergency security update for its ColdFusion software, addressing several critical vulnerabilities, one of which is a new zero-day that has been exploited in attacks. The update was released outside of the regular patching schedule, indicating the severity of the vulnerabilities.

Among the vulnerabilities fixed are a critical remote code execution (RCE) flaw identified as CVE-2023-38204 with a severity rating of 9.8, a critical improper access control flaw, CVE-2023-38205, with a rating of 7.8, and a moderate improper access control flaw, CVE-2023-38206, with a rating of 5.3.

While CVE-2023-38204 is the most severe vulnerability patched in this update, it was not exploited in the wild. However, Adobe has confirmed that the CVE-2023-38205 flaw was used in limited attacks. In their security bulletin, Adobe stated, "Adobe is aware that CVE-2023-38205 has been exploited in the wild in limited attacks targeting Adobe ColdFusion."

The CVE-2023-38205 flaw is a patch bypass for the fix for CVE-2023-29298, a ColdFusion authentication bypass discovered by Rapid7 researchers Stephen Fewer on July 11th. On July 13th, Rapid7 observed attackers exploiting the CVE-2023-29298 and what appeared to be the CVE-2023-29300/CVE-2023-38203 flaws to install webshells on vulnerable ColdFusion servers to gain remote access to devices.

On July 17th, Rapid7 discovered that the patch for the CVE-2023-29298 vulnerability could be bypassed and reported this to Adobe. In their report, Rapid7 stated, "Rapid7 researchers determined on Monday, July 17 that the fix Adobe provided for CVE-2023-29298 on July 11 is incomplete, and that a trivially modified exploit still works against the latest version of ColdFusion (released July 14). We have notified Adobe that their patch is incomplete."

Adobe has now confirmed that the fix for the CVE-2023-29298 vulnerability is included in the APSB23-47 as the CVE-2023-38205 patch. As this vulnerability is being actively exploited to take control of ColdFusion servers, Adobe strongly recommends that website operators install the update as soon as possible.

Related News

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.