Adobe ColdFusion Deserialization Flaw Patched
IPA warns of a deserialization vulnerability in Adobe ColdFusion (CVE-2024-41874) that could allow arbitrary code execution and urges immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA (Information-technology Promotion Agency) issued an advisory regarding CVE-2024-41874, a vulnerability in Adobe ColdFusion application server caused by improper validation of data prior to deserialization. If exploited, the flaw could allow a third party to execute arbitrary code on affected systems.
The advisory notes that damage could expand in the future and recommends that administrators apply the fixes provided by Adobe following the vendor's published procedures. No evidence of active exploitation is cited in the alert; it is a patch-now recommendation based on the risk of arbitrary code execution.
Mentioned in this report
Detection guidance
ColdFusion Deserialization RCE - Java Process Spawning from cfml.jar
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
ColdFusion JVM process (java.exe/javaw.exe with cfml.jar in command line) spawning unexpected child processes - indicative of deserialization gadget chain RCE execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Deserialization RCE - Java Process Spawning from cfml.jar
description: Detects java.exe or javaw.exe running ColdFusion (cfml.jar in command
line) spawning child processes like cmd.exe, powershell.exe, or other shells - characteristic
of CVE-2024-41874 deserialization RCE exploitation.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains: cfml.jar
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \certutil.exe
- \bitsadmin.exe
filter_legitimate_cf_admin:
ParentCommandLine|contains:
- cfusion-admin
- cf-admin
condition: selection_parent and selection_child and not filter_legitimate_cf_admin
falsepositives:
- ColdFusion scheduled tasks or jobs that legitimately invoke system commands
- Custom ColdFusion applications explicitly designed to shell out to system utilities
level: high
id: 53a77144-a7ad-5d9e-a5be-265c80ecaf9a
status: experimental
author: Vorant
ColdFusion HTTP Request Handler Executing Unexpected Binary
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
ColdFusion's cfusion.exe or coldfusion.exe process (or jrun/jvm process identified as CF runtime) spawning processes with suspicious network activity or file write patterns - post-exploitation of deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion HTTP Request Handler Executing Unexpected Binary
description: Detects ColdFusion application server processes (cfusion.exe, coldfusion.exe,
or java running CF) spawning child processes that write to suspicious directories
(temp, appdata, programdata) or execute from network paths - pattern of post-exploitation
after deserialization RCE.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_cf_parent:
ParentImage|endswith:
- \cfusion.exe
- \coldfusion.exe
- \java.exe
ParentCommandLine|contains:
- coldfusion
- cfusion
- jrun
selection_suspicious_child:
Image|endswith:
- \powershell.exe
- \cmd.exe
- \csc.exe
- \msbuild.exe
- \rundll32.exe
CommandLine|contains:
- C:\\Windows\\Temp
- C:\\Temp
- '%temp%'
- '%appdata%'
- '%programdata%'
condition: selection_cf_parent and selection_suspicious_child
falsepositives:
- ColdFusion extensions or plugins that legitimately use temp directories for file
operations
- Legacy ColdFusion configurations where admin scripts intentionally invoke system
binaries
level: medium
id: cdcba75e-0756-5d7f-bc3c-4b877553fcf4
status: experimental
author: Vorant
ColdFusion Unexpected Java Serialized Object Deserialization
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
ColdFusion process (java runtime) receiving HTTP POST requests followed by immediate spawning of child processes or file modifications - deserialization gadget chain execution post-HTTP request. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Unexpected Java Serialized Object Deserialization
description: Detects ColdFusion JVM process opening network listening ports and immediately
executing child processes in response to inbound requests - behavioral signature
of Java deserialization exploitation (CVE-2024-41874).
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_cf_proc:
Image|endswith: \java.exe
CommandLine|contains:
- cfusion
- coldfusion
- jrun
selection_execution:
ParentImage|endswith: \java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \notepad.exe
- \whoami.exe
- \ipconfig.exe
filter_coldfusion_services:
CommandLine|contains:
- -Dcoldfusion.server.mode=development
- CFusionMX
condition: selection_cf_proc and selection_execution and not filter_coldfusion_services
falsepositives:
- Legitimate ColdFusion diagnostic or monitoring tools that execute system commands
- ColdFusion development environments with debugging enabled
level: medium
id: f1bafd6e-21a8-5541-874d-b7def5ba03bf
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240911.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs