ColdFusion flaw exploited for webshells in Japan

17 April 2024 high threat government-nationaltechnologyinfrastructure

Attackers exploited Adobe ColdFusion vulnerability CVE-2023-29300 to plant webshells on at least 66 devices in Japan, risking ORB-style relay abuse.

IPA (Japan's Information-technology Promotion Agency) reports that network-perimeter appliances running Adobe ColdFusion have been compromised via CVE-2023-29300, a remote code execution flaw already listed in CISA's Known Exploited Vulnerabilities catalog. Multiple domestic organizations had webshells installed on affected ColdFusion instances, and Taiwanese security vendor TeamT5 reported on March 18, 2024 that at least 66 devices in Japan were compromised through this vulnerability.

IPA warns that such network-penetrating attacks often lead to compromised devices being repurposed as Operational Relay Boxes (ORBs) — used to relay C2 traffic or obscure attacker origin, potentially turning victim organizations into unwitting stepping stones for further attacks against third parties. The advisory draws a parallel to the Volt Typhoon campaign in the US and Europe, which similarly abused vulnerable network devices (including TP-Link routers) for ORB-style relay infrastructure targeting critical infrastructure.

IPA urges organizations running Adobe ColdFusion to urgently apply patches per Adobe's APSB23-40 advisory (which also covers two additional vulnerabilities) and to review connection logs for signs of compromise or ORB-style relay activity, even if patches have already been applied. Organizations detecting evidence of exploitation are encouraged to report to IPA's contact point.

Mentioned in this report

Vulnerabilities CVE-2023-29300KEV

Threat actors Volt Typhoon

Malware Webshell

Campaigns Volt Typhoon

Detection guidance

ColdFusion Remote Code Execution via CVE-2023-29300

ATT&CK T1190

Detects HTTP requests to Adobe ColdFusion admin interfaces with suspicious RCE payload patterns targeting known CVE-2023-29300 vulnerability endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ColdFusion Remote Code Execution via CVE-2023-29300
description: Detects HTTP POST requests to ColdFusion administrator API endpoints
  with characteristics of CVE-2023-29300 exploitation attempts, including unusual
  serialized object payloads or deserialization gadget chains.
tags:
- attack.t1190
logsource:
  category: web_application_firewall
  product: cfw
detection:
  selection:
    http_method: POST
    uri_path|contains:
    - /api/v1/cfusion/deployment
    - /CFIDE/administrator
    - /cfdocs/
    query_string|contains:
    - java.lang.Runtime
    - ysoserial
    - ClassPathXmlApplicationContext
    - ProcessBuilder
  filter_legitimate_admin:
    source_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate ColdFusion administrator access from internal networks during patching
- Security scanning tools probing ColdFusion instances for known CVEs
level: critical
id: e72e6359-a980-5517-8f73-a5299c955680
status: experimental
author: Vorant

Webshell Upload to ColdFusion Directory

ATT&CK T1505.003

Detects file creation of common webshell extensions in ColdFusion application directories, indicative of post-exploitation persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Webshell Upload to ColdFusion Directory
description: Detects creation of executable script files (JSP, CFM, CFML, ASP) in
  typical ColdFusion web-accessible directories following successful exploitation.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \cfusion\
    - \ColdFusion\
    - \wwwroot\
    - \inetpub\
    TargetFilename|endswith:
    - .cfm
    - .cfml
    - .jsp
    - .jspx
    - .asp
    - .aspx
    EventType: CreateKey
  filter_legitimate_cf_install:
    TargetFilename|contains:
    - Exchange
    - documentation
    - examples
    - sample
  condition: selection and not filter_legitimate_cf_install
falsepositives:
- ColdFusion installer or update packages deploying new application files
- Legitimate application deployments to ColdFusion servers
level: high
id: 5b938071-f511-5a2a-99f1-9f065c5570b9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_orb.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free