More Scope Injection for Fun and Profit (or, why those security updates broke your functions)

Introduction 

Like "Big Two-Hearted River," my last post also has a Part II.  I had previously spent countless hours trying to create a UDFMethod object from user-controlled data via the Service Layer endpoints and eventually gave up decided it was just not possible.  But I had learned more about how lots of ColdFusion internals work -- including variable casting, object types, and functions.  And I kept at it.  While I wasn't able to achieve remote code execution, I ultimately did find a few new scope injection vulnerabilities later on.  These vulnerabilities highlight a broader and often overlooked risk: assumptions about scope isolation and variable safety can quietly break down at the framework level. When that happens, even well-intentioned application logic can become vulnerable in unexpected ways.

The corresponding patches for these vulnerabilities introduced breaking changes with the security fixes -- specifically, the requirement to explicitly declare all arguments for remote functions from APSB25-52 and the changes around scope precedence and variable name reserved words from APSB25-105. Read on as we explore the technical details of how they work and what the underlying risks are.

Districton 1 Slides - Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion

It was an honor to speak at DistrictCon Year 1 (which is its second year.  Unlike ColdFusion, DistrictCon counts from 0. 😀)

I got some great questions and feedback after my talk, attended a bunch interesting sessions, and really enjoyed the weekend.  And yes, there was snow.  Lots and lots of snow.  But the conference team, hotel staff, and attendees all handled the weather incredibly well.  I'm already looking forward to next year, and thinking about potential Junkyard targets...

The slides from my talk -- Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion -- are now available online below.  Be sure to check out my longer blog post talking about several of the vulnerabilities covered in my presentation too!

Dead Ends, Red Herrings, and Failures In Our Time

On the good days in security research, you get to channel equal parts Archimedes and Ric Ocasek in your successes. The pieces all come together as expected, the hunches turn into reality, everything just works.  And you should, of course, celebrate those moments of eureka and magic that went into your discovery, since your newest exploit is often your favorite exploit.  Though there's the rub -- your favorite exploit may forever be the one that you haven't found yet.  The perennial next one.

But this post isn't about successes in security research; it's about the failures.  If you're lucky, failure comes quickly.  A guess or a "what about..." falls apart and is disproven in minutes and not hours (or longer).  Plus every failure is an opportunity to use what you've learned about an application or a protocol or whatever in the future.  The work that goes into ten dead ends from poring over source code or RFCs can lead to a much better understanding of the overall system.  And those failures might lead you to something that you otherwise wouldn't have found or wouldn't have thought about.  Something real.  But not today.

Today we'll be looking at some ColdFusion vulnerability research that was interesting and promising at first look, but ultimately wasn't exploitable in the way I had hoped.  

RCE via ColdFusion ARchive (CAR) Deployment: One Example of an Authenticated Attack Path in CFAdmin (CVE-2025-61808)

Introduction

In this post we'll be looking at one way that an authenticated user with only ColdFusion Administration (CFAdmin) access can achieve remote code execution; this attack scenario could be used to model a rogue CFAdmin user without full server-level access, or an external attacker who is able to obtain unauthorized access to CFAdmin and then bootstrap further escalation and access.

The CFAdmin web interface introduces a large attack surface to ColdFusion environments.  That shouldn’t be a surprise since it adds a substantial default codebase intended to provide hooks into sensitive functionality.  When performing a threat model it could be perfectly reasonable to equate a CFAdmin compromise with a full system compromise.   In many organizations, the users with CFAdmin access may also be platform system administrators – with full, direct access to the underlying operating system.  If that's the case, a malicious CFAdmin user is equivalent to a malicious system administrator, and you’re cooked either way.  

But with that said, Adobe has extended considerable effort to protect and secure CFAdmin.  From monthly security patches, to webserver connectors and connector updates, to fixing other authenticated CFAdmin exploit paths – CFAdmin has become more secure over time.  And in some environments, CFAdmin access versus full platform access are distinct access roles, prompting organizations to care about all authenticated CFAdmin exploitation vectors.

Digging Through Six Old Sandbox Escapes in ColdFusion (ca. 2001 through 2012)

Time for some vulnerability archaeology!  I'm sure you're as excited as I am.  In a previous post I covered a technique to generate precompiled Java bytecode to bypass Sandbox Security restrictions in Adobe ColdFusion (CVE-2025-30288).  And Sandbox Security was first released with ColdFusion 4 in November 1998, so it's been around for quite some time.  Perhaps reading that post made you wonder about historical sandbox escapes in ColdFusion.  If it did, then consider this post an early Christmas present. 🎁  

Sandbox Security Escapes in ColdFusion and Lucee (CVE-2025-30288 and CVE-2024-55354)

Introduction

In this post I'm going to cover the technical details of a security sandbox escape technique that affects Adobe ColdFusion and Lucee Server.  These vulnerabilities are tracked as CVE-2025-30288 and CVE-2024-55354, and were announced in April 2025.  The resulting patches changed the default way that ColdFusion handled precompiled CFML (Java bytecode) in .cfm and .cfc files.

Before we get into the technical details, it's worth noting that an attacker needs to be able to write files to the server in order to exploit the vulnerability.  As a result, this vulnerability is primarily a risk to shared hosting environments where CFML sandbox controls are in use.  (If an attacker or malicious user can write files to your single-tenant environment, you probably have bigger, more immediate security concerns beyond sandbox escapes.)

Get ready for what I hope is an interesting trip through ColdFusion internals, some Java, and other technical depths.  This was a fun one to find, explore, and exploit. 

CFCamp 2025 Slides - Understanding CFML Vulnerabilities, Exploits, and Attack Paths

 In May I had the pleasure of attending my first CFCamp, where I spoke about CFML security.

The slides from my talk -- Understanding CFML Vulnerabilities, Exploits, and Attack Paths -- are now online below.  With an added bonus of Bavaria in Springtime!

An SSRF to LFI Payload for PDF Generators (CVE-2024-34112 and beyond)

"Hola, amigos. How’s it hangin’? I know it’s been a long time since I last rapped at ya, but I've been busier than a feather plucker on nickel wing night, ya know?  You old buddy Jimbo found some discarded books out back next to the dumpster at the inconvenience store about something called 'Cold Fusion' and I've been reading through those bad boys.  Shoulda called it CON-Fusion if ya ask me.  But I've been having trouble reading the printed word and gettin' these awful headaches ever since I popped in side two of 'Hemispheres' and lit up some sweet Thai Stick I found underneath the passenger side seat of my crapbox Festiva -- that turned out to be the taquito I dropped last July after the Dane County Fair.  It just goes to show ya, yours truly can't catch a break in this world."

[ It was at this point that we decided it wouldn't be a good idea to let Mr. Anchower write the entire blog post.  We weren't wrong.   -Ed. ]

Ahem.  Quick post for today on an SSRF payload that can potentially be used for local file retrieval.  I'll be framing it in the context of CVE-2024-34112, but it could be a viable attack against any application that is doing server-side PDF generation with user-controlled data.  

An Initial Analysis of Adobe ColdFusion CVE-2024-53961

A ColdFusion security patch released two days before Christmas?  I have a feeling that may have resulted in many sysadmins shouting "Fiddlesticks!" (or perhaps another f-word) earlier today.  And on that note, may I suggest this perfect album for a little holiday cheer after the servers have been patched, the wine has been mulled, and the goose has been roasted to perfection:

Ghosts of Vulnerabilities Past?

Adobe released APSB24-107 today, which addresses one vulnerability in ColdFusion tracked as CVE-2024-53961 and described as a path traversal that could lead to file retrieval.  Based on a quick review of the corresponding patches, it appears to be a security enhancement that improves protection (and possibly remediates bypasses) against the attack vectors first addressed in APSB24-14 / CVE-2024-20767 back in March.  

BSidesLV 2024 Slides - Modern ColdFusion Exploitation and Attack Surface Reduction

Thank you to BSidesLV for the opportunity to speak this year.  The slides from my talk, Modern ColdFusion Exploitation and Attack Surface Reduction, are now online below.  They're pretty similar to my Summercon slides, with a few updates.

On ColdFusion Administrator Access Control Bypass Techniques

Introduction

Access Control is frequently boring but important.  It's one of the core security services defined in the OSI Security Architecture reference model.  And it's illustrative of what Erasmus and Franklin (not to mention many doctors, nutritionists, and personal trainers) had to say about preventions versus cures.  An attacker can't exploit what he can't access.

Let's pretend you're a jewel thief who wants to steal a bag of jewels locked securely in a bedroom wall safe.  Before you can get down to the art and science of safecracking, you need to get access to the safe first.  The bedroom and the wall safe are protected areas that any passing jewel thief shouldn't be able to just walk up to and start poking at.  Your path to the wall safe would likely have layered security controls -- a locked front door, motion sensors, lasers, CCTV cameras, dogs, bees, dogs with bees in their mouths and when they bark they shoot bees at you, etc. -- that may deter you or at least make your job more difficult.

Looking at CFAdmin

Think of the ColdFusion Administrator (CFAdmin) -- the web-based interface for configuring and managing your ColdFusion environment -- in the same way as that wall safe.  You want to protect and restrict access to CFAdmin as part of your security baseline.  CFAdmin components are accessible via /CFIDE/ URI paths and expose lots of functionality; most components require authentication (a local username/password, or LDAP as of ColdFusion 2023) to access, although some are accessible without authentication.  So proper access control is crucial.

Summercon 2024 Slides - Modern ColdFusion Exploitation and Attack Surface Reduction

Last Friday it was an absolute honor to talk about ColdFusion security at Summercon.  Summercon was the first security conference I attended and it remains my favorite after many years, as BlackHat has gotten enormous and other cons have run their course.  The slides from my talk Modern ColdFusion Exploitation and Attack Surface Reduction are below.  This talk is the result of several years of thinking about, examining, and researching the attack surface of ColdFusion from both offensive and defensive perspectives.  I'll also be giving the talk again at BSides Las Vegas next month -- with some updated slides, content, and surprises.

Defending Against CVE-2024-20767 (ColdFusion Arbitrary File System Read)

Technical details for CVE-2024-20767 (ColdFusion Arbitrary File System Read) from APSB24-14 have now been publicly disclosed by the researcher who reported it to Adobe PSIRT:  https://jeva.cc/2973.html

It's a great finding with an interesting two-step exploit process that combines obtaining a server UUID value from a CFAdmin API endpoint and then using that UUID to access a PMSGenericServlet module (part of the Performance Monitoring Toolset) that can be abused to read local files.

One Reason Why Your ColdFusion Server May Still Be Vulnerable Even With the Latest Security Updates Installed

Next Tuesday is Adobe Patch Tuesday.  Will there be new ColdFusion security updates?  I have no idea.  But even if there are no new patches released, and your ColdFusion servers already have the latest updates installed, you may still be missing an important step in keeping them secure.

What Does ColdFusion's verifyClient() Do?

I recently saw a ColdFusion question about verifyClient and remote CFC functions.  I already have strong opinions about why you don't want to use remote CFC functions, but I was unfamiliar with verifyClient.  That led me to take a look at how it works and I thought it was interesting enough to write about.  

Critical Variable Mass Assignment Vulnerability in Adobe ColdFusion (CVE-2023-44350)

Background

Adobe ColdFusion is vulnerable to a Mass Assignment vulnerability that can result in an attacker being able to modify the value of any variable in any scope within the context of remote CFC methods.  A mass assignment vulnerability occurs when application code allows a user to set or modify arbitrary objects or values without verifying that the user is authorized to do so.  Modifying values related to authorization checks, security controls, or other important functions may permit a malicious user to access sensitive data or perform other unexpected actions.  Mass assignment vulnerabilities are not unique to ColdFusion and have affected other languages including ASP.NET, PHP, and Ruby on Rails. 

ColdFusion, Connectors, and CFAdmin Security (for more than just ColdFusion 2023 Update 5 and ColdFusion 2021 Update 11)

Introduction

This post is about ColdFusion 2023 Update 5 and ColdFusion 2021 Update 11, but it's also about more than just those versions.  Because access to the ColdFusion Administrator (CFAdmin) should be tightly controlled regardless of what version of ColdFusion you're running.  

The release notes for CF2023 U5 and CF2021 U11 mention unspecific "connector-related enhancements," with no details.  It appears that these enhancements include much stricter default access control to CFAdmin resources through the connectors.  The new connectors will block all access to CFAdmin resources, so you'll need direct access to Tomcat (or your alternate Java Application Server) to access CFAdmin.  ColdFusion expert Charlie Arehart and a few others have made comments here and here regarding this new behavior as well.  

Exploiting CVE-2017-11286 Six Years Later: XXE in ColdFusion via WDDX Packet

Introduction

🎈🎂🎂🎂🎂🎂🎂🎈Six years ago today, on September 12, 2017, Adobe released APSB17-30.  Among three other vulnerabilities*, it included a patch for CVE-2017-11286 a Critical XML eXternal entities (XXE) bug in ColdFusion.  This vulnerability was found and reported to Adobe by Daniel Lawson of Depth Security.  While digging into some ColdFusion internals recently, I walked back through history and stumbled on this vulnerability, and figured it was interesting enough for a detailed write-up.

Technical Details for CVE-2023-29301: Adobe ColdFusion Access Control Bypass for a CFAdmin Authentication Component

Background

In this post I'll be walking though CVE-2023-29301, which is an access control bypass / password brute force vulnerability in Adobe ColdFusion that I reported to Adobe and was fixed on July 11, 2023 in Adobe Product Security Bulletin APSB23-40.  Note that this is an access control bypass and is not an authentication bypass vulnerability.  

On ColdFusion, AES, and Padding Oracle Attacks: Hic Sunt Dracones

TL; DR: If you use AES-CBC (or another block cipher operating in CBC mode) to decrypt user-controlled ciphertext, validate the ciphertext with an HMAC or similar integrity check prior to decryption to avoid Padding Oracle vulnerabilities.  All user-controlled input is untrusted and can be dangerous, even if it is encrypted data.