Adobe ColdFusion CVE-2023-29300 exploited across Japan
IPA Japan warns of active exploitation of Adobe ColdFusion CVE-2023-29300 with at least 66 compromised systems in Japan, webshells deployed, and ORB weaponization observed.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-29300 as exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) has confirmed active exploitation of CVE-2023-29300, a remote code execution vulnerability in Adobe ColdFusion, targeting multiple organizations domestically. According to Taiwan-based security vendor TeamT5, at least 66 systems in Japan have been compromised through this vulnerability, with webshells deployed on affected ColdFusion servers. The attacks follow a network-penetration pattern where internet-boundary devices are exploited to gain initial access.
The compromised systems are being weaponized as Operational Relay Boxes (ORBs), serving as intermediary infrastructure for command-and-control communications and attack obfuscation. IPA has observed these compromised devices being used to relay C2 traffic and conceal attacker origins, potentially making victim organizations unwitting participants in further attacks. The advisory draws parallels to the Volt Typhoon campaign targeting critical infrastructure in Western nations and previous APT operations against TP-Link routers in Japan.
IPA urges immediate patching of Adobe ColdFusion systems and retrospective investigation of communication logs even for already-patched systems to detect potential ORB compromise. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, and the associated Adobe advisory APSB23-40 addresses two additional vulnerabilities requiring remediation.
Mentioned in this report
Detection guidance
Adobe ColdFusion Spawning Suspicious Child Process (CVE-2023-29300 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects ColdFusion/Java service process spawning command interpreters or scripting engines, indicative of RCE exploitation via CVE-2023-29300. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Spawning Command Interpreter
id: a1864c31-a55e-56b5-b848-dc1fbac2e685
status: experimental
description: Detects Adobe ColdFusion (cfusion/coldfusion) or its underlying Java
process spawning a shell or scripting interpreter, consistent with exploitation
of CVE-2023-29300 to achieve remote code execution and drop webshells.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- cfusion
- coldfusion
- jrun
ParentImage|endswith:
- java.exe
- jrun.exe
selection_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\certutil.exe
- \\mshta.exe
- \\rundll32.exe
- \\bitsadmin.exe
filter_admin:
CommandLine|contains:
- \\backup\\
- scheduled_task_helper
condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate ColdFusion administrative scripts that shell out for scheduled maintenance
tasks
- Third-party monitoring agents integrated with ColdFusion that invoke command-line
utilities
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant
Webshell File Written to ColdFusion Web Root by Java Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of JSP/CFM script files within ColdFusion web-accessible directories by the ColdFusion/Java runtime, indicating webshell deployment following exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Script File Dropped by ColdFusion Process
id: 6a167970-98af-5742-8b39-ab9f6ec92e3b
status: experimental
description: Detects the ColdFusion service or its Java process writing new .jsp,
.cfm, or .cfc files into web-accessible directories, consistent with webshell deployment
after exploitation of CVE-2023-29300.
logsource:
category: file_event
product: windows
detection:
selection_process:
Image|contains:
- cfusion
- coldfusion
Image|endswith:
- java.exe
- jrun.exe
selection_target:
TargetFilename|endswith:
- .jsp
- .jspx
- .cfm
- .cfc
TargetFilename|contains:
- \\wwwroot\\
- \\cfusion\\wwwroot\\
- \\webapps\\
filter_deploy:
TargetFilename|contains:
- \\deploy\\release_
condition: selection_process and selection_target and not filter_deploy
falsepositives:
- Legitimate application deployment or CI/CD pipelines pushing new CFM/JSP pages to
production
- Developer manual updates to ColdFusion application code on the same host
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
Compromised Server Acting as Relay/Proxy Node (ORB) via ColdFusion Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a ColdFusion/Java process establishing outbound network connections to multiple external destinations on non-standard ports, consistent with use of the compromised server as an Operational Relay Box for C2 traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Initiating Outbound Relay-Like Connections
id: 51bff838-2ded-53c1-89c3-169cd53df1cd
status: experimental
description: Detects the ColdFusion/Java service process establishing outbound network
connections to external hosts on ports not typically used by ColdFusion, which may
indicate the compromised server is being used as an Operational Relay Box (ORB)
to proxy C2 traffic, as described in the CVE-2023-29300 exploitation campaign.
logsource:
category: network_connection
product: windows
detection:
selection_process:
Image|contains:
- cfusion
- coldfusion
Image|endswith:
- java.exe
- jrun.exe
selection_conn:
Initiated: true
DestinationPort:
- 443
- 8443
- 4443
- 1080
- 9001
filter_internal:
DestinationIp|startswith:
- '10.'
- 192.168.
- 172.16.
condition: selection_process and selection_conn and not filter_internal
falsepositives:
- ColdFusion legitimate outbound calls to licensed update servers or Adobe telemetry
endpoints
- Application-level HTTPS calls to third-party APIs configured within ColdFusion applications
level: medium
tags:
- attack.t1090
- attack.command-and-control
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_orb.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs