Adobe ColdFusion deserialization flaw CVE-2024-41874
Adobe ColdFusion contains a deserialization vulnerability (CVE-2024-41874) allowing remote code execution; patches are available and should be applied immediately.
Japan's IPA has issued an advisory regarding a critical deserialization vulnerability in Adobe ColdFusion application servers. The flaw, tracked as CVE-2024-41874, stems from improper validation of deserialized data and allows unauthenticated attackers to execute arbitrary code remotely.
Adobe has released patches addressing this vulnerability across affected ColdFusion versions. IPA warns that exploitation risks are increasing and urges organizations to apply the vendor-provided updates immediately following Adobe's published remediation procedures. The advisory notes that third-party attackers could leverage this flaw to gain code execution on vulnerable servers.
Organizations running Adobe ColdFusion should prioritize patching this vulnerability to prevent potential compromise. The IPA advisory was published on September 11, 2024, with a minor correction issued the same day.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe ColdFusion Server
Detects command shells or scripting engines spawned from ColdFusion/Java server processes, indicative of post-exploitation following a deserialization RCE such as CVE-2024-41874. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe ColdFusion Server
id: 03986568-c688-5f7e-948e-d02e43dde4c8
status: experimental
description: Detects cmd/powershell/sh/bash or other living-off-the-land binaries
spawned as children of ColdFusion (cfusion/java) processes, consistent with exploitation
of a deserialization vulnerability such as CVE-2024-41874 that grants remote code
execution on the application server.
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- cfusion
- coldfusion
- jrun
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \certutil.exe
- \whoami.exe
- \net.exe
- \bitsadmin.exe
- \sh
- \bash
filter_benign:
CommandLine|contains:
- ColdFusion Administrator
- health check
condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Administrative scripts intentionally launched by ColdFusion scheduled tasks
- Legitimate monitoring or health-check scripts invoked by the application server
level: high
Web Shell File Written by ColdFusion Process
Detects creation of script files (jsp, cfm, cfc) in ColdFusion webroot directories by the ColdFusion/Java server process itself, indicating a possible web shell drop following exploitation of a deserialization vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Written by ColdFusion Process
id: 1db1e529-df1a-5949-b2fb-5183e7ab07d3
status: experimental
description: Detects the ColdFusion/Java server process writing new script files (.jsp,
.cfm, .cfc) into web-accessible directories, a common post-exploitation step after
remote code execution via a deserialization flaw such as CVE-2024-41874, used to
establish persistent web shell access.
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- cfusion
- coldfusion
- jrun
TargetFilename|endswith:
- .jsp
- .jspx
- .cfm
- .cfc
filter_benign:
TargetFilename|contains:
- \wwwroot\CFIDE\administrator\
condition: selection and not filter_benign
falsepositives:
- Legitimate application deployment or update processes writing new ColdFusion templates
- Administrator-initiated code deployment through CI/CD pipelines
level: high
Outbound Network Connection Initiated by ColdFusion Process
Detects the ColdFusion/Java server process initiating outbound network connections shortly after handling requests, consistent with a reverse shell or callback established through exploitation of a deserialization vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Network Connection Initiated by ColdFusion Process
id: ce66b596-9be9-5ae4-b243-b7d2ff2472e9
status: experimental
description: Detects the ColdFusion (cfusion/jrun/java) server process initiating
outbound network connections to non-standard destinations, a behavior consistent
with a reverse shell or command-and-control callback established after exploitation
of a deserialization RCE such as CVE-2024-41874.
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- cfusion
- coldfusion
- jrun
Initiated: 'true'
filter_common_ports:
DestinationPort:
- 80
- 443
- 8500
- 8443
condition: selection and not filter_common_ports
falsepositives:
- ColdFusion legitimately calling external web services, APIs, or license servers
over non-standard ports
- Internal health checks or monitoring agents embedded in the ColdFusion process
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240911.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free