CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-29300 is a CRITICAL severity deserialization vulnerability in Adobe ColdFusion affecting versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. The vulnerability allows remote attackers to execute arbitrary code on vulnerable ColdFusion servers without any authentication or user interaction by sending a specially crafted serialized data payload. Adobe ColdFusion’s deserialization of untrusted data enables attackers to control the server-side object graph, leading to full system compromise. CVE-2023-29300 has been associated with ransomware attacks and is included in CISA’s Known Exploited Vulnerabilities catalog. With a CVSS score of 9.8 and an EPSS score of 93.7%, this vulnerability represents one of the most severe and actively exploited threats to ColdFusion deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2018; 2021; 2023 |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29300(Third Party Advisory, US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a weakness where an application deserializes data from an untrusted source without adequate validation, allowing an attacker to supply a malicious serialized payload that, when processed, executes arbitrary code or alters application logic. In CVE-2023-29300, Adobe ColdFusion deserializes attacker-controlled data, enabling remote code execution without requiring any prior authentication on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-29300 is rated CRITICAL with a CVSS 3.1 score of 9.8, reflecting the most severe possible exploitability characteristics. The vulnerability is remotely exploitable without physical access, requires no authentication, involves no user interaction, and has low attack complexity — meaning no special conditions, configurations, or preconditions are required beyond a reachable ColdFusion server. Confidentiality (High): Attackers can read all data accessible to the ColdFusion server process, including application code, credentials, and customer data. Integrity (High): Full code execution enables arbitrary file modification, webshell installation, and persistent backdoor placement. Availability (High): Attackers can disrupt or completely disable the ColdFusion server. The KEV ransomware flag is marked as true, confirming that CVE-2023-29300 has been exploited in ransomware campaigns, making it a top-priority vulnerability for immediate remediation across all ColdFusion installations.
Exploit Maturity
CVE-2023-29300 is actively exploited in the wild. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024. Critically, the KEV ransomware indicator is true, confirming that CVE-2023-29300 has been leveraged in ransomware campaigns against organizations running unpatched Adobe ColdFusion. The EPSS score of 93.7% (99.8th percentile) indicates near-certain ongoing exploitation activity across the internet. While no specific public proof-of-concept exploit link is available among the provided references, the combination of ransomware use, KEV listing, and near-maximum EPSS score indicates this vulnerability is being exploited routinely by both financially motivated attackers and advanced persistent threat groups.
Remediation
- Apply the Adobe security patch immediately: Per CISA KEV guidance, apply mitigations per vendor instructions or discontinue use of the product. Apply Adobe security bulletin APSB23-40, which addresses CVE-2023-29300 for ColdFusion 2018, 2021, and 2023.
- Upgrade to patched versions: Upgrade Adobe ColdFusion 2018 to Update 17 or later, ColdFusion 2021 to Update 7 or later, and ColdFusion 2023 to the patched release following 2023.0.0.330468.
- Restrict network access to ColdFusion admin interfaces: Place ColdFusion servers behind a web application firewall (WAF) and restrict access to admin endpoints. Block direct external access to ColdFusion’s administrator and RMI ports.
- Disable unnecessary serialization endpoints: Where possible, disable or restrict access to ColdFusion features that accept serialized objects from remote clients, particularly any WDDX or AMF endpoints.
- Monitor for indicators of compromise: Review ColdFusion server logs for unexpected process spawning, unusual outbound network connections, and webshell file creation. Given known ransomware usage, treat any anomalous activity on ColdFusion servers as a potential breach indicator requiring immediate incident response.
Technical Details
CVE-2023-29300 exploits Adobe ColdFusion’s deserialization mechanism, classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability exists in ColdFusion’s handling of serialized Java objects or ColdFusion-specific serialized data formats, where the deserialization process instantiates attacker-controlled class instances without sufficient validation, triggering so-called “gadget chains” that result in arbitrary code execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible, zero-click attack requiring no privileges and achieving full system impact. Affected versions include ColdFusion 2018 through u16, 2021 through u6, and 2023.0.0.330468 and earlier. The vulnerability was addressed in Adobe security bulletin APSB23-40. Its confirmed use in ransomware operations and high EPSS score of 93.7% demonstrate active, widespread exploitation by sophisticated threat actors targeting unpatched ColdFusion servers.
Frequently Asked Questions
Is CVE-2023-29300 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-29300 in the wild, including use in ransomware campaigns (KEV ransomware flag: true). The EPSS score of 93.7% (99.8th percentile) confirms extremely high and ongoing exploitation probability. Any unpatched Adobe ColdFusion instance should be treated as potentially compromised.
What products are affected by CVE-2023-29300?
CVE-2023-29300 affects Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. All three supported ColdFusion release branches require patching. ColdFusion installations upgraded per Adobe security bulletin APSB23-40 are protected.
How do I fix CVE-2023-29300?
Apply Adobe security bulletin APSB23-40 immediately. Upgrade ColdFusion 2018 to Update 17 or later, ColdFusion 2021 to Update 7 or later, and ColdFusion 2023 to the post-330468 release. Additionally, restrict external access to ColdFusion admin interfaces and review server logs for signs of compromise.
How severe is CVE-2023-29300?
CVE-2023-29300 is rated CRITICAL with a CVSS 3.1 score of 9.8, the maximum possible on the scale. It is remotely exploitable with no authentication and no user interaction required, and has been used in ransomware attacks. The EPSS score of 93.7% confirms this is among the most actively exploited vulnerabilities in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.