Adobe ColdFusion path traversal exposes arbitrary files
Adobe ColdFusion path traversal vulnerability (CVE-2024-53961) allows unauthenticated remote attackers to read arbitrary system files; PoC code exists in the wild.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA has issued an alert regarding a path traversal vulnerability in Adobe ColdFusion application server, tracked as CVE-2024-53961. The vulnerability allows unauthenticated remote attackers to read arbitrary system files on affected systems. Adobe has confirmed that proof-of-concept exploit code for this vulnerability is circulating, significantly increasing the risk of active exploitation. Given the availability of PoC code and the severity of unauthorized file access, IPA warns that attacks may escalate and urges immediate patching. Adobe has released fixed versions of ColdFusion to address this issue, and organizations are advised to upgrade following the vendor's published procedures.
Mentioned in this report
Detection guidance
Path Traversal Attempt Against Adobe ColdFusion Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to ColdFusion administrative or CFM endpoints containing directory traversal sequences indicative of CVE-2024-53961 exploitation attempts to read arbitrary files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Attempt Against Adobe ColdFusion Endpoint
id: c6bfccff-4dba-5434-964b-5cdafdfca47e
status: experimental
description: Detects web requests to ColdFusion endpoints (CFIDE, cf_scripts, administrator
paths) that contain path traversal sequences, consistent with CVE-2024-53961 exploitation
allowing unauthenticated arbitrary file read.
references:
- https://www.adobe.com/devnet/coldfusion.html
logsource:
category: webserver
product: null
detection:
selection_path:
cs-uri-query|contains:
- ..%2f
- ..%5c
- ..\\
- ../
- '%2e%2e%2f'
- '%2e%2e/'
selection_target:
cs-uri-stem|contains:
- /CFIDE/
- /cf_scripts/
- /administrator/
- .cfm
- .cfc
condition: selection_path and selection_target
falsepositives:
- Vulnerability scanners or penetration testing tools probing ColdFusion instances
- Legitimate applications passing file paths with encoded characters (rare)
level: high
tags:
- attack.t1005
- attack.initial-access
- cve.2024.53961
author: Vorant
ColdFusion Server Process Spawning Command Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the ColdFusion/Java server process spawning a command interpreter, which may indicate post-exploitation activity following file disclosure or credential theft via CVE-2024-53961. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Server Process Spawning Command Shell
id: a8ba34af-a6c3-5d0f-8b6c-2f00d7fef969
status: experimental
description: Detects cmd.exe, powershell.exe, or sh/bash being spawned by ColdFusion
or its underlying Java/JRun process. This is unusual for normal ColdFusion operation
and may indicate exploitation leading to remote code execution or use of harvested
valid credentials to execute commands.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- coldfusion
- jrun
- cfserver
- \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate ColdFusion administrative scripts invoking command-line utilities
- Scheduled maintenance tasks configured to run via ColdFusion scheduler
level: high
tags:
- attack.t1078
- attack.execution
- attack.t1059
- cve.2024.53961
author: Vorant
Sensitive Configuration File Read by ColdFusion Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the ColdFusion process opening or reading sensitive OS or application configuration files (e.g., password stores, /etc/passwd, web.xml) outside its expected webroot, consistent with arbitrary file read via CVE-2024-53961. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sensitive Configuration File Read by ColdFusion Process
id: eebb0d47-14b1-5186-ac35-863a13fbaf6b
status: experimental
description: Detects file access events where the ColdFusion server process reads
sensitive system or credential files located outside its typical web application
directories, which may indicate exploitation of a path traversal vulnerability such
as CVE-2024-53961 to harvest data or credentials for later use as valid accounts.
logsource:
category: file_event
product: windows
detection:
selection_process:
Image|contains:
- coldfusion
- jrun
- cfserver
selection_target:
TargetFilename|contains:
- password.properties
- \Windows\win.ini
- \drivers\etc\hosts
- neo-datasource.xml
- seed.properties
- /etc/passwd
- /etc/shadow
condition: selection_process and selection_target
falsepositives:
- ColdFusion administrative tools legitimately accessing their own configuration files
during startup
- Backup or patching processes reading configuration files as part of maintenance
level: medium
tags:
- attack.t1005
- attack.collection
- cve.2024.53961
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20241224.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs