Adobe · ColdFusion
Adobe ColdFusion contains a Java deserialization flaw in its bundled Apache BlazeDS library, which affects ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier. An attacker who can reach the affected ColdFusion service over the network, without needing credentials or any user interaction, can exploit the flaw to achieve arbitrary code execution.
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
First seen exploited 16 months after disclosure. Public exploit code (Exploit-DB) appeared 9 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Arbitrary code execution is the direct impact
Successful exploitation could lead to arbitrary code execution
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-3066 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…we first observed this actor exploiting vulnerabilities in Apache Struts, we've also observed what we believe to the same individual exploiting an Oracle WebLogic server vulnerability (CVE-2017-10271), and also exploiting CVE-2017-3066, a critical Java deserialization vulnerability in the Adobe ColdFusion…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.