VORANT. Threat Intelligence Sign in Get the full feed

Adobe ColdFusion CVE-2023-29300 exploited in Japan

high threat government-nationalinfrastructure

IPA confirms multiple Japanese organizations compromised via CVE-2023-29300 in Adobe ColdFusion, with webshells deployed and devices weaponized as operational relay boxes.

Japan's Information-technology Promotion Agency (IPA) has confirmed active exploitation of CVE-2023-29300, a remote code execution vulnerability in Adobe ColdFusion, affecting multiple domestic organizations. Attackers deployed webshells on compromised systems, establishing persistent access for network-penetration attacks. According to Taiwan-based vendor TeamT5, at least 66 devices in Japan have been compromised through this vulnerability, which appears on CISA's Known Exploited Vulnerabilities catalog.

The advisory warns that compromised devices are being weaponized as Operational Relay Boxes (ORBs) — intermediate infrastructure used to relay command-and-control traffic and obscure attacker origins, potentially implicating victims in attacks against third parties. IPA draws parallels to the Volt Typhoon campaign targeting critical infrastructure and references APT exploitation of TP-Link routers in similar ORB operations.

IPA urges immediate patching for all Adobe ColdFusion deployments and recommends log analysis to detect compromise even on patched systems. Organizations are advised to check for webshell deployment and ORB activity, with affected parties encouraged to report incidents to IPA's information-sharing portal.

Mentioned in this report

Vulnerabilities CVE-2023-29300KEV
Threat actors Volt Typhoon
Campaigns Volt Typhoon

Detection guidance

Adobe ColdFusion Spawning Command Shell Processes (Possible CVE-2023-29300 Exploitation)

ATT&CK T1190

Detects the ColdFusion Java process spawning cmd.exe or powershell.exe, consistent with post-exploitation of CVE-2023-29300 leading to webshell deployment or command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Adobe ColdFusion Spawning Command Shell Processes
id: f62f7b5c-1899-5446-b672-af99926837f3
status: experimental
description: Detects ColdFusion (cfusion/java) spawning cmd.exe, powershell.exe, or
  other shell interpreters, indicative of exploitation of Adobe ColdFusion vulnerabilities
  such as CVE-2023-29300 leading to remote code execution or webshell deployment.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \cfusion\jre\bin\java.exe
    - \coldfusion\jre\bin\java.exe
    - \cfusion.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \certutil.exe
  condition: selection_parent and selection_child
falsepositives:
- ColdFusion administrator scheduled tasks or scripted maintenance jobs that legitimately
  invoke shell utilities
- Third-party ColdFusion extensions that call out to command-line tools for legitimate
  processing
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant

Webshell File Written by ColdFusion Java Process

ATT&CK T1505.003

Detects creation of script/webshell files (jsp, cfm, cfc, jspx) by the ColdFusion Java process in web-accessible directories, consistent with webshell deployment following CVE-2023-29300 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Webshell File Written by ColdFusion Java Process
id: 413b29fc-95e2-5d78-ba14-8f0d2b6b1819
status: experimental
description: Detects the ColdFusion Java process creating new script files (.jsp,
  .jspx, .cfm, .cfc) in ColdFusion webroot directories, which may indicate webshell
  deployment after successful exploitation of an Adobe ColdFusion RCE vulnerability
  such as CVE-2023-29300.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \cfusion\jre\bin\java.exe
    - \coldfusion\jre\bin\java.exe
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .cfm
    - .cfc
  filter:
    TargetFilename|contains:
    - \wwwroot\CFIDE\administrator\
  condition: selection and not filter
falsepositives:
- Legitimate ColdFusion application deployments or updates that write new .cfm/.cfc
  files as part of normal development or CI/CD pipelines
- ColdFusion patch or upgrade processes that regenerate administrative templates
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

ColdFusion Java Process Making Outbound Network Connections to Unusual Ports

ATT&CK T1090

Detects the ColdFusion Java process initiating outbound network connections to non-standard remote ports, potentially indicating use of a compromised ColdFusion server as an Operational Relay Box (ORB) for proxying C2 traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ColdFusion Java Process Outbound Connection to Unusual Port
id: fb48e47d-c46f-551c-9c3d-b7ca45360d52
status: experimental
description: Detects the ColdFusion Java process (cfusion/java.exe) initiating outbound
  network connections to remote ports not typically associated with ColdFusion or
  common web/database services, which may indicate the compromised server is being
  used as an Operational Relay Box (ORB) to proxy command-and-control traffic.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \cfusion\jre\bin\java.exe
    - \coldfusion\jre\bin\java.exe
    Initiated: 'true'
  filter:
    DestinationPort:
    - 80
    - 443
    - 1433
    - 1521
    - 3306
    - 5432
    - 8500
    - 8443
  condition: selection and not filter
falsepositives:
- ColdFusion application code making legitimate outbound calls to third-party APIs
  or web services on non-standard ports
- Internal monitoring or update-check connections initiated by the ColdFusion server
  itself
level: medium
tags:
- attack.t1090
- attack.command_and_control
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_orb.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free