CVE-2018-15961
Adobe ColdFusion Unrestricted File Upload Vulnerability
Description
CVE-2018-15961 is a critical-severity unrestricted file upload vulnerability in Adobe ColdFusion that enables arbitrary code execution. The flaw affects ColdFusion 2018 (July 12 release, version 2018.0.0.310739), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier. An unauthenticated attacker can exploit this vulnerability remotely to upload malicious files, such as web shells, to the server without any user interaction. CISA has added CVE-2018-15961 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 94.42% (99.98th percentile), this Adobe ColdFusion vulnerability has one of the highest exploitation probabilities observed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 11.0; 2016; 2018 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/105314(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041621(Broken Link, Third Party Advisory, VDB Entry)
- https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html(Vendor Advisory)
- https://www.exploit-db.com/exploits/45979/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15961(Third Party Advisory, US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating or restricting file types. In Adobe ColdFusion, this vulnerability allows attackers to upload executable files such as web shells (JSP or CFML scripts) directly to the server, providing persistent remote code execution capabilities without authentication.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2018-15961 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the most severe vulnerability classification. The unrestricted file upload vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction, creating a maximally dangerous exposure. Successful exploitation allows an attacker to upload executable files to the ColdFusion server, achieving persistent remote code execution with the privileges of the application service account. This impacts confidentiality, integrity, and availability at the highest level, enabling data theft, system modification, and complete service disruption. The EPSS score of 94.42% (99.98th percentile) places this vulnerability in the top tier of exploitation likelihood across all known CVEs, indicating extensive and ongoing weaponization. Organizations running unpatched internet-facing ColdFusion instances are at near-certain risk of compromise.
Exploit Maturity
CVE-2018-15961 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.42% (99.98th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities across all known CVEs. Public exploit code is available for CVE-2018-15961 via Exploit Database, significantly lowering the barrier for attackers. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive. The availability of public exploit code combined with the trivial exploitation path of uploading a web shell makes this vulnerability exceptionally dangerous and accessible to a wide range of threat actors.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the security updates from Adobe Security Bulletin APSB18-33 for ColdFusion 2018, 2016, and 11.
- Verify that all ColdFusion instances have been updated past the vulnerable versions: ColdFusion 2018 past the July 12 release, ColdFusion 2016 past Update 6, and ColdFusion 11 past Update 14. If running end-of-life versions, plan immediate migration to a supported release.
- Implement strict file upload validation on the ColdFusion server: enforce a whitelist of allowed file extensions, validate file content using magic bytes rather than extensions alone, store uploaded files outside the web root, and ensure uploaded files cannot be executed by the web server.
- Conduct a thorough scan of web-accessible directories for web shells or suspicious files that may have been uploaded prior to patching. Monitor file system changes on the ColdFusion server for newly created executable files (JSP, CFML, CFM). Deploy WAF rules to detect and block file upload exploitation attempts.
- Restrict network access to ColdFusion administration interfaces. Run the ColdFusion service with minimal operating system privileges, and implement application-level sandboxing to limit the impact of code execution through uploaded files.
Technical Details
CVE-2018-15961 is an unrestricted file upload vulnerability (CWE-434) affecting Adobe ColdFusion 2018 (version 2018.0.0.310739), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier. The vulnerability exists because the ColdFusion application fails to properly validate or restrict the types of files that can be uploaded through its file upload functionality, allowing attackers to upload executable content such as JSP or CFML web shells. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) demonstrates maximum exploitability with network-based access, low complexity, no authentication, and no user interaction. Once a web shell is uploaded and accessible via the web server, the attacker gains persistent command execution capabilities on the server, enabling data exfiltration, lateral movement, malware deployment, and complete infrastructure compromise.
Frequently Asked Questions
Is CVE-2018-15961 being actively exploited?
Yes. CVE-2018-15961 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.42% (99.98th percentile) indicates near-certain exploitation activity. Public exploit code is available on Exploit Database, making this vulnerability accessible to a broad range of attackers.
What products are affected by CVE-2018-15961?
CVE-2018-15961 affects three Adobe ColdFusion product lines: ColdFusion 2018 (July 12 release, version 2018.0.0.310739), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier. All three versions require security updates.
How do I fix CVE-2018-15961?
Apply the security updates from Adobe Security Bulletin APSB18-33 for all affected ColdFusion versions. Additionally, implement strict file upload validation with extension whitelisting, store uploads outside the web root, and scan for web shells that may have been uploaded before patching.
How severe is CVE-2018-15961?
CVE-2018-15961 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. With an EPSS score at the 99.98th percentile and publicly available exploit code, this is among the most dangerous and most exploited Adobe ColdFusion vulnerabilities. Immediate remediation is critical.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.