Adobe ColdFusion path traversal vulnerability (CVE-2024-53961) allows unauthenticated…
Adobe ColdFusion path traversal vulnerability (CVE-2024-53961) allows unauthenticated remote attackers to read arbitrary system files; PoC code exists in the wild.
Japan's IPA has issued an alert regarding a path traversal vulnerability in Adobe ColdFusion application server, tracked as CVE-2024-53961. The vulnerability allows unauthenticated remote attackers to read arbitrary system files on affected systems. Adobe has confirmed that proof-of-concept exploit code for this vulnerability is circulating, significantly increasing the risk of active exploitation. Given the availability of PoC code and the severity of unauthorized file access, IPA warns that attacks may escalate and urges immediate patching. Adobe has released fixed versions of ColdFusion to address this issue, and organizations are advised to upgrade following the vendor's published procedures.
Mentioned in this report
Detection guidance
Path Traversal Attempt Against Adobe ColdFusion Endpoint
Detects HTTP requests to ColdFusion administrative or CFM endpoints containing directory traversal sequences indicative of CVE-2024-53961 exploitation attempts to read arbitrary files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Attempt Against Adobe ColdFusion Endpoint
id: c6bfccff-4dba-5434-964b-5cdafdfca47e
status: experimental
description: Detects web requests to ColdFusion endpoints (CFIDE, cf_scripts, administrator
paths) that contain path traversal sequences, consistent with CVE-2024-53961 exploitation
allowing unauthenticated arbitrary file read.
references:
- https://www.adobe.com/devnet/coldfusion.html
logsource:
category: webserver
product: null
detection:
selection_path:
cs-uri-query|contains:
- ..%2f
- ..%5c
- ..\\
- ../
- '%2e%2e%2f'
- '%2e%2e/'
selection_target:
cs-uri-stem|contains:
- /CFIDE/
- /cf_scripts/
- /administrator/
- .cfm
- .cfc
condition: selection_path and selection_target
falsepositives:
- Vulnerability scanners or penetration testing tools probing ColdFusion instances
- Legitimate applications passing file paths with encoded characters (rare)
level: high
tags:
- attack.t1005
- attack.initial-access
- cve.2024.53961
author: Vorant
ColdFusion Server Process Spawning Command Shell
Detects the ColdFusion/Java server process spawning a command interpreter, which may indicate post-exploitation activity following file disclosure or credential theft via CVE-2024-53961. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Server Process Spawning Command Shell
id: a8ba34af-a6c3-5d0f-8b6c-2f00d7fef969
status: experimental
description: Detects cmd.exe, powershell.exe, or sh/bash being spawned by ColdFusion
or its underlying Java/JRun process. This is unusual for normal ColdFusion operation
and may indicate exploitation leading to remote code execution or use of harvested
valid credentials to execute commands.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- coldfusion
- jrun
- cfserver
- \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate ColdFusion administrative scripts invoking command-line utilities
- Scheduled maintenance tasks configured to run via ColdFusion scheduler
level: high
tags:
- attack.t1078
- attack.execution
- attack.t1059
- cve.2024.53961
author: Vorant
Sensitive Configuration File Read by ColdFusion Process
Detects the ColdFusion process opening or reading sensitive OS or application configuration files (e.g., password stores, /etc/passwd, web.xml) outside its expected webroot, consistent with arbitrary file read via CVE-2024-53961. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sensitive Configuration File Read by ColdFusion Process
id: eebb0d47-14b1-5186-ac35-863a13fbaf6b
status: experimental
description: Detects file access events where the ColdFusion server process reads
sensitive system or credential files located outside its typical web application
directories, which may indicate exploitation of a path traversal vulnerability such
as CVE-2024-53961 to harvest data or credentials for later use as valid accounts.
logsource:
category: file_event
product: windows
detection:
selection_process:
Image|contains:
- coldfusion
- jrun
- cfserver
selection_target:
TargetFilename|contains:
- password.properties
- \Windows\win.ini
- \drivers\etc\hosts
- neo-datasource.xml
- seed.properties
- /etc/passwd
- /etc/shadow
condition: selection_process and selection_target
falsepositives:
- ColdFusion administrative tools legitimately accessing their own configuration files
during startup
- Backup or patching processes reading configuration files as part of maintenance
level: medium
tags:
- attack.t1005
- attack.collection
- cve.2024.53961
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20241224.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free