VORANT. Threat Intelligence Sign in Get the full feed

Adobe ColdFusion CVE-2023-29300 exploited across Japan

medium threat infrastructure

IPA Japan warns of active exploitation of Adobe ColdFusion CVE-2023-29300 with at least 66 compromised systems in Japan, webshells deployed, and ORB weaponization observed.

Japan's Information-technology Promotion Agency (IPA) has confirmed active exploitation of CVE-2023-29300, a remote code execution vulnerability in Adobe ColdFusion, targeting multiple organizations domestically. According to Taiwan-based security vendor TeamT5, at least 66 systems in Japan have been compromised through this vulnerability, with webshells deployed on affected ColdFusion servers. The attacks follow a network-penetration pattern where internet-boundary devices are exploited to gain initial access.

The compromised systems are being weaponized as Operational Relay Boxes (ORBs), serving as intermediary infrastructure for command-and-control communications and attack obfuscation. IPA has observed these compromised devices being used to relay C2 traffic and conceal attacker origins, potentially making victim organizations unwitting participants in further attacks. The advisory draws parallels to the Volt Typhoon campaign targeting critical infrastructure in Western nations and previous APT operations against TP-Link routers in Japan.

IPA urges immediate patching of Adobe ColdFusion systems and retrospective investigation of communication logs even for already-patched systems to detect potential ORB compromise. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, and the associated Adobe advisory APSB23-40 addresses two additional vulnerabilities requiring remediation.

Mentioned in this report

Vulnerabilities CVE-2023-29300KEV
Threat actors Volt Typhoon
Campaigns Volt Typhoon

Detection guidance

Adobe ColdFusion Spawning Suspicious Child Process (CVE-2023-29300 Exploitation)

ATT&CK T1190

Detects ColdFusion/Java service process spawning command interpreters or scripting engines, indicative of RCE exploitation via CVE-2023-29300. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ColdFusion Process Spawning Command Interpreter
id: a1864c31-a55e-56b5-b848-dc1fbac2e685
status: experimental
description: Detects Adobe ColdFusion (cfusion/coldfusion) or its underlying Java
  process spawning a shell or scripting interpreter, consistent with exploitation
  of CVE-2023-29300 to achieve remote code execution and drop webshells.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - cfusion
    - coldfusion
    - jrun
    ParentImage|endswith:
    - java.exe
    - jrun.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\certutil.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\bitsadmin.exe
  filter_admin:
    CommandLine|contains:
    - \\backup\\
    - scheduled_task_helper
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate ColdFusion administrative scripts that shell out for scheduled maintenance
  tasks
- Third-party monitoring agents integrated with ColdFusion that invoke command-line
  utilities
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant

Webshell File Written to ColdFusion Web Root by Java Process

ATT&CK T1505.003

Detects creation of JSP/CFM script files within ColdFusion web-accessible directories by the ColdFusion/Java runtime, indicating webshell deployment following exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Script File Dropped by ColdFusion Process
id: 6a167970-98af-5742-8b39-ab9f6ec92e3b
status: experimental
description: Detects the ColdFusion service or its Java process writing new .jsp,
  .cfm, or .cfc files into web-accessible directories, consistent with webshell deployment
  after exploitation of CVE-2023-29300.
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|contains:
    - cfusion
    - coldfusion
    Image|endswith:
    - java.exe
    - jrun.exe
  selection_target:
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .cfm
    - .cfc
    TargetFilename|contains:
    - \\wwwroot\\
    - \\cfusion\\wwwroot\\
    - \\webapps\\
  filter_deploy:
    TargetFilename|contains:
    - \\deploy\\release_
  condition: selection_process and selection_target and not filter_deploy
falsepositives:
- Legitimate application deployment or CI/CD pipelines pushing new CFM/JSP pages to
  production
- Developer manual updates to ColdFusion application code on the same host
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

Compromised Server Acting as Relay/Proxy Node (ORB) via ColdFusion Host

ATT&CK T1090

Detects a ColdFusion/Java process establishing outbound network connections to multiple external destinations on non-standard ports, consistent with use of the compromised server as an Operational Relay Box for C2 traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ColdFusion Process Initiating Outbound Relay-Like Connections
id: 51bff838-2ded-53c1-89c3-169cd53df1cd
status: experimental
description: Detects the ColdFusion/Java service process establishing outbound network
  connections to external hosts on ports not typically used by ColdFusion, which may
  indicate the compromised server is being used as an Operational Relay Box (ORB)
  to proxy C2 traffic, as described in the CVE-2023-29300 exploitation campaign.
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|contains:
    - cfusion
    - coldfusion
    Image|endswith:
    - java.exe
    - jrun.exe
  selection_conn:
    Initiated: true
    DestinationPort:
    - 443
    - 8443
    - 4443
    - 1080
    - 9001
  filter_internal:
    DestinationIp|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection_process and selection_conn and not filter_internal
falsepositives:
- ColdFusion legitimate outbound calls to licensed update servers or Adobe telemetry
  endpoints
- Application-level HTTPS calls to third-party APIs configured within ColdFusion applications
level: medium
tags:
- attack.t1090
- attack.command_and_control
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_orb.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free