CVE-2017-3066
Adobe ColdFusion Deserialization Vulnerability
Description
CVE-2017-3066 is a critical Java deserialization vulnerability in Adobe ColdFusion that allows remote attackers to achieve arbitrary code execution via the Apache BlazeDS library. Affecting ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier, this vulnerability carries a CVSS v3.1 base score of 9.8 — the highest severity rating. CISA has added CVE-2017-3066 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 17, 2025, and its EPSS score of 93.36% at the 99.8th percentile confirms near-certain exploitation, making it one of the most actively exploited ColdFusion vulnerabilities ever documented.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 10.0; 11.0; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98003(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038364(Broken Link, Third Party Advisory, VDB Entry)
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/43993/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066(US Government Resource)
Weakness Type
Deserialization of Untrusted Data
CVE-2017-3066 is rooted in a Java deserialization vulnerability within the Apache BlazeDS library bundled with Adobe ColdFusion. Deserialization of untrusted data occurs when an application reconstructs objects from serialized data streams without adequate validation, allowing an attacker to craft malicious serialized objects that execute arbitrary code upon deserialization. In this case, the BlazeDS library processes AMF (Action Message Format) requests containing serialized Java objects, and the lack of proper input validation allows an attacker to inject specially crafted objects that trigger code execution on the ColdFusion server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2017-3066 poses a catastrophic risk to organizations running vulnerable Adobe ColdFusion servers. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), making it trivially exploitable by any attacker who can reach the ColdFusion server. Confidentiality (High): Arbitrary code execution grants the attacker full access to all data on the ColdFusion server, including database credentials, application source code, session tokens, and any files accessible to the ColdFusion service account. Integrity (High): An attacker can modify application logic, inject backdoors into ColdFusion applications, alter database records, and plant persistent web shells for ongoing access. Availability (High): Complete system compromise allows the attacker to shut down services, encrypt files, or destroy data at will. The EPSS score of 93.36% at the 99.8th percentile means this vulnerability is being exploited with near certainty. The ransomware status is listed as Unknown, but the arbitrary code execution capability makes ColdFusion servers exploited via CVE-2017-3066 prime targets for ransomware deployment, cryptocurrency mining, and data exfiltration campaigns.
Exploit Maturity
CVE-2017-3066 has reached maximum exploit maturity with publicly available, weaponized exploit code. A fully functional exploit is available on Exploit-DB (entry 43993), providing attackers with a ready-to-use tool for exploiting vulnerable ColdFusion installations. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 17, 2025. The EPSS score of 93.36% at the 99.8th percentile places CVE-2017-3066 among the top 0.2% of all tracked vulnerabilities in terms of exploitation probability, confirming sustained and widespread exploitation over the years since its disclosure in April 2017. The ransomware use status is listed as Unknown by CISA. Adobe has published the security bulletin APSB17-14 with patches addressing this vulnerability.
Remediation
-
Apply the Adobe ColdFusion security update immediately. Install the patches described in Adobe Security Bulletin APSB17-14. Update ColdFusion 2016 to Update 4 or later, ColdFusion 11 to Update 12 or later, and ColdFusion 10 to Update 23 or later. If running end-of-life versions, upgrade to a currently supported ColdFusion release.
-
Upgrade to a modern ColdFusion version. ColdFusion 10 and 11 have reached end of life and no longer receive security updates. Migrate to Adobe ColdFusion 2023 or later to ensure ongoing protection against newly discovered vulnerabilities.
-
Restrict network access to ColdFusion servers. Ensure that ColdFusion administration interfaces and BlazeDS AMF endpoints are not exposed to the public internet. Implement firewall rules and reverse proxy configurations to limit access to trusted networks only.
-
Deploy a web application firewall (WAF). Configure WAF rules to inspect and block malicious AMF (Action Message Format) requests targeting BlazeDS deserialization endpoints. Many WAF solutions include signatures specifically designed to detect Java deserialization attack payloads.
-
Conduct forensic analysis of exposed servers. Given the long exploitation history of CVE-2017-3066, perform a thorough security audit of any ColdFusion servers that may have been exposed. Search for web shells, unauthorized user accounts, modified application files, and suspicious outbound network connections.
Technical Details
CVE-2017-3066 is a Java deserialization vulnerability in the Apache BlazeDS library that is bundled with Adobe ColdFusion versions 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability characteristics: Attack Vector (Network): The vulnerability is exploitable remotely through HTTP requests to the ColdFusion server's BlazeDS AMF endpoints, which are exposed by default. Attack Complexity (Low): Exploitation is straightforward using publicly available tools and requires no special conditions. Privileges Required (None): No authentication is needed to send malicious AMF requests to the BlazeDS endpoint. User Interaction (None): The attack is fully automated and requires no action from any user. Impact (High across all dimensions): Successful exploitation results in arbitrary code execution with the privileges of the ColdFusion service account. The root cause is the Apache BlazeDS library's handling of AMF (Action Message Format) messages. When ColdFusion processes incoming AMF requests, the BlazeDS library deserializes the embedded Java objects without sufficient validation of their content or class types. An attacker crafts a malicious AMF message containing a serialized Java object that, upon deserialization, triggers a chain of method invocations (a "gadget chain") leading to arbitrary command execution on the underlying operating system. Common exploitation techniques leverage well-known Java deserialization gadget chains from libraries present in the ColdFusion classpath.
Frequently Asked Questions
Is CVE-2017-3066 being actively exploited?
Yes. CVE-2017-3066 has been actively exploited since its disclosure in April 2017, and CISA has added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.36% at the 99.8th percentile confirms near-certain exploitation, and public exploit code is readily available on Exploit-DB.
What products are affected by CVE-2017-3066?
CVE-2017-3066 affects Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier. All three versions bundle the vulnerable Apache BlazeDS library that enables the Java deserialization attack.
How do I fix CVE-2017-3066?
Apply the patches from Adobe Security Bulletin APSB17-14, which updates the BlazeDS library. For ColdFusion 10 and 11, which are end-of-life, the recommended approach is to upgrade to a currently supported ColdFusion version. Additionally, restrict network access to BlazeDS AMF endpoints.
Can CVE-2017-3066 be exploited without authentication?
Yes. CVE-2017-3066 requires no authentication whatsoever. The vulnerable BlazeDS AMF endpoints are accessible without any credentials, allowing any attacker with network access to the ColdFusion server to send malicious deserialization payloads and achieve arbitrary code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.