Adobe ColdFusion Deserialization Flaw Patched
IPA warns of a deserialization vulnerability in Adobe ColdFusion (CVE-2024-41874) that could allow arbitrary code execution and urges immediate patching.
Japan's IPA (Information-technology Promotion Agency) issued an advisory regarding CVE-2024-41874, a vulnerability in Adobe ColdFusion application server caused by improper validation of data prior to deserialization. If exploited, the flaw could allow a third party to execute arbitrary code on affected systems.
The advisory notes that damage could expand in the future and recommends that administrators apply the fixes provided by Adobe following the vendor's published procedures. No evidence of active exploitation is cited in the alert; it is a patch-now recommendation based on the risk of arbitrary code execution.
Mentioned in this report
Detection guidance
ColdFusion Deserialization RCE - Java Process Spawning from cfml.jar
ColdFusion JVM process (java.exe/javaw.exe with cfml.jar in command line) spawning unexpected child processes - indicative of deserialization gadget chain RCE execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Deserialization RCE - Java Process Spawning from cfml.jar
description: Detects java.exe or javaw.exe running ColdFusion (cfml.jar in command
line) spawning child processes like cmd.exe, powershell.exe, or other shells - characteristic
of CVE-2024-41874 deserialization RCE exploitation.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains: cfml.jar
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \certutil.exe
- \bitsadmin.exe
filter_legitimate_cf_admin:
ParentCommandLine|contains:
- cfusion-admin
- cf-admin
condition: selection_parent and selection_child and not filter_legitimate_cf_admin
falsepositives:
- ColdFusion scheduled tasks or jobs that legitimately invoke system commands
- Custom ColdFusion applications explicitly designed to shell out to system utilities
level: high
id: 53a77144-a7ad-5d9e-a5be-265c80ecaf9a
status: experimental
author: Vorant
ColdFusion HTTP Request Handler Executing Unexpected Binary
ColdFusion's cfusion.exe or coldfusion.exe process (or jrun/jvm process identified as CF runtime) spawning processes with suspicious network activity or file write patterns - post-exploitation of deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion HTTP Request Handler Executing Unexpected Binary
description: Detects ColdFusion application server processes (cfusion.exe, coldfusion.exe,
or java running CF) spawning child processes that write to suspicious directories
(temp, appdata, programdata) or execute from network paths - pattern of post-exploitation
after deserialization RCE.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_cf_parent:
ParentImage|endswith:
- \cfusion.exe
- \coldfusion.exe
- \java.exe
ParentCommandLine|contains:
- coldfusion
- cfusion
- jrun
selection_suspicious_child:
Image|endswith:
- \powershell.exe
- \cmd.exe
- \csc.exe
- \msbuild.exe
- \rundll32.exe
CommandLine|contains:
- C:\\Windows\\Temp
- C:\\Temp
- '%temp%'
- '%appdata%'
- '%programdata%'
condition: selection_cf_parent and selection_suspicious_child
falsepositives:
- ColdFusion extensions or plugins that legitimately use temp directories for file
operations
- Legacy ColdFusion configurations where admin scripts intentionally invoke system
binaries
level: medium
id: cdcba75e-0756-5d7f-bc3c-4b877553fcf4
status: experimental
author: Vorant
ColdFusion Unexpected Java Serialized Object Deserialization
ColdFusion process (java runtime) receiving HTTP POST requests followed by immediate spawning of child processes or file modifications - deserialization gadget chain execution post-HTTP request. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Unexpected Java Serialized Object Deserialization
description: Detects ColdFusion JVM process opening network listening ports and immediately
executing child processes in response to inbound requests - behavioral signature
of Java deserialization exploitation (CVE-2024-41874).
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_cf_proc:
Image|endswith: \java.exe
CommandLine|contains:
- cfusion
- coldfusion
- jrun
selection_execution:
ParentImage|endswith: \java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \notepad.exe
- \whoami.exe
- \ipconfig.exe
filter_coldfusion_services:
CommandLine|contains:
- -Dcoldfusion.server.mode=development
- CFusionMX
condition: selection_cf_proc and selection_execution and not filter_coldfusion_services
falsepositives:
- Legitimate ColdFusion diagnostic or monitoring tools that execute system commands
- ColdFusion development environments with debugging enabled
level: medium
id: f1bafd6e-21a8-5541-874d-b7def5ba03bf
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240911.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free