CVE-2023-38203
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-38203 is a CRITICAL severity deserialization vulnerability in Adobe ColdFusion affecting versions 2018u17 and earlier, 2021u7 and earlier, and 2023u1 and earlier. Like its closely related predecessor CVE-2023-29300, this vulnerability allows unauthenticated remote attackers to achieve arbitrary code execution by exploiting ColdFusion’s insecure deserialization of untrusted data, with no user interaction required. Adobe ColdFusion’s deserialization handling in these versions enables attackers to supply malicious serialized payloads that trigger full server compromise. CVE-2023-38203 is included in CISA’s Known Exploited Vulnerabilities catalog and has been associated with ransomware campaigns. With a CVSS score of 9.8 and an EPSS score of 94.3% (99.9th percentile), this is one of the most aggressively exploited vulnerabilities in the Adobe ColdFusion ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2018; 2021; 2023 |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38203(Third Party Advisory, US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes the risk that arises when an application deserializes data supplied by untrusted sources. In the context of CVE-2023-38203, Adobe ColdFusion processes attacker-supplied serialized objects without adequate type or content validation, enabling the construction of exploit gadget chains that ultimately execute arbitrary operating system commands or code on the affected server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-38203 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting fully unauthenticated remote exploitation with no user interaction and low attack complexity. The vulnerability is remotely exploitable without physical access, meaning any internet-facing or network-reachable ColdFusion server running a vulnerable version is at risk. Confidentiality (High): Attackers gain unrestricted read access to all data accessible by the ColdFusion process, including credentials, customer data, and application secrets. Integrity (High): Full code execution enables persistent backdoor installation, configuration tampering, and lateral movement within the network. Availability (High): Attackers can crash, disable, or encrypt ColdFusion services, consistent with the confirmed ransomware usage for this vulnerability. The KEV ransomware indicator is true, and the EPSS score of 94.3% (99.9th percentile) establishes this as among the most certainly exploited vulnerabilities tracked by NVD.
Exploit Maturity
CVE-2023-38203 is actively exploited in the wild with ransomware involvement confirmed. CISA has included this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024, and the KEV ransomware indicator is marked true, confirming real-world use in ransomware operations targeting Adobe ColdFusion deployments. The EPSS score of 94.3% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation activity. Adobe addressed the vulnerability in security bulletin APSB23-41, and its proximity in scope and affected versions to CVE-2023-29300 suggests it may have been discovered as a bypass or extension of the earlier attack surface. Organizations running unpatched ColdFusion should treat any anomalous server activity as a potential breach.
Remediation
- Apply the Adobe security patch immediately: Per CISA KEV guidance, apply mitigations per vendor instructions as described in Adobe security bulletin APSB23-41, which addresses CVE-2023-38203 for ColdFusion 2018, 2021, and 2023.
- Upgrade to patched versions: Update Adobe ColdFusion 2018 to Update 18 or later, ColdFusion 2021 to Update 8 or later, and ColdFusion 2023 to Update 2 or later to eliminate this vulnerability.
- Implement serial filter / deny-listing: Enable and configure Java serialization filters within ColdFusion and the underlying JVM to restrict which classes can be deserialized, reducing gadget chain availability even on temporarily unpatched systems.
- Restrict access to ColdFusion endpoints: Deploy a web application firewall to inspect and block malformed serialized requests. Limit ColdFusion administrative interfaces and any AMF, WDDX, or RMI services to trusted IP ranges only.
- Conduct post-incident review if patching was delayed: Given the extremely high EPSS and confirmed ransomware exploitation, any ColdFusion server that was unpatched during the active exploitation window should be forensically reviewed for signs of compromise, including webshells, new user accounts, scheduled tasks, or unusual outbound connections before being returned to production.
Technical Details
CVE-2023-38203 is rooted in CWE-502 (Deserialization of Untrusted Data) within Adobe ColdFusion’s object deserialization subsystem. The vulnerability enables remote attackers to craft a serialized payload that, when deserialized by the ColdFusion server, triggers execution of attacker-controlled code by chaining together existing Java classes in a so-called gadget chain. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms this is a fully unauthenticated, zero-click, network-exploitable attack with complete impact on confidentiality, integrity, and availability. CVE-2023-38203 affects slightly later ColdFusion versions than the closely related CVE-2023-29300, suggesting that the initial patches for the earlier vulnerability were insufficient or that an additional deserialization vector was identified. Adobe addressed this issue in security bulletin APSB23-41, with patches released across the ColdFusion 2018, 2021, and 2023 branches.
Frequently Asked Questions
Is CVE-2023-38203 being actively exploited?
Yes. CVE-2023-38203 is included in CISA’s Known Exploited Vulnerabilities catalog with confirmed active exploitation in the wild, including use in ransomware campaigns. The EPSS score of 94.3% (99.9th percentile) is among the highest possible, reflecting widespread and ongoing exploitation targeting unpatched Adobe ColdFusion servers.
What products are affected by CVE-2023-38203?
CVE-2023-38203 affects Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier, and 2023u1 and earlier. All three supported ColdFusion release branches are vulnerable. ColdFusion installations patched per Adobe security bulletin APSB23-41 are protected.
How do I fix CVE-2023-38203?
Apply Adobe security bulletin APSB23-41 immediately. Upgrade ColdFusion 2018 to Update 18 or later, ColdFusion 2021 to Update 8 or later, and ColdFusion 2023 to Update 2 or later. Given confirmed ransomware usage, also conduct a forensic review of any ColdFusion servers that were unpatched during the active exploitation window.
How severe is CVE-2023-38203?
CVE-2023-38203 is rated CRITICAL with a CVSS 3.1 score of 9.8. It is a fully unauthenticated, zero-click remote code execution vulnerability. Combined with confirmed ransomware exploitation and an EPSS score of 94.3% (99.9th percentile), it represents one of the highest-severity and most actively exploited vulnerabilities in recent Adobe ColdFusion history.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.