Skip to main content
Mallory
Back to vulnerabilities
CriticalCISA KEVExploited in the wildPublic exploit

Adobe ColdFusion Apache BlazeDS Java Deserialization RCE

IdentifiersCVE-2017-3066CWE-502· Deserialization of Untrusted Data

CVE-2017-3066 is a Java deserialization vulnerability in the Apache BlazeDS library bundled with Adobe ColdFusion. According to the provided content, the issue affects Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier. Unsafe deserialization of attacker-controlled data in BlazeDS can allow a remote attacker to trigger arbitrary code execution on the ColdFusion server. Adobe addressed the issue by shipping hotfixes that include an updated version of Apache BlazeDS.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to arbitrary code execution on the vulnerable ColdFusion server. In practical terms, this can give an attacker the ability to execute commands in the context of the ColdFusion service, deploy follow-on payloads such as webshells or malware, and fully compromise the affected server. The supplied context specifically notes observed exploitation of public-facing vulnerable servers and use of the flaw to deliver malware, including China Chopper as a second-stage payload.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of ColdFusion servers, especially public-facing instances, and implement Adobe-recommended security configuration settings and Lockdown guide controls. Restrict access to ColdFusion endpoints to trusted networks where feasible, monitor for exploitation attempts and unexpected webshell or malware deployment, and prioritize patching because the vulnerability has been actively exploited in the wild.

Remediation

Patch, then assume compromise.

Apply Adobe's security hotfixes and upgrade to the fixed releases identified in the provided advisory: ColdFusion 2016 Update 4, ColdFusion 11 Update 12, or ColdFusion 10 Update 23. Adobe's bulletin also recommends following the relevant Adobe technical notes and applying the recommended security configurations. The hotfixes include an updated Apache BlazeDS version to address the deserialization issue.
PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app
ColdFusionPwnMaturityPoCVerified exploit

This repository provides 'ColdFusionPwn', a Java-based exploit tool for CVE-2017-3066, a deserialization vulnerability in Adobe ColdFusion 11 and 12. The tool generates malicious AMF (Action Message Format) payloads using ysoserial gadget chains, which, when deserialized by a vulnerable ColdFusion server, result in arbitrary command execution. The main entry point is 'ColdFusionPwner.java', which takes arguments specifying the exploit technique, ysoserial gadget type, command to execute, and output file for the payload. The repository includes supporting Java classes to craft the payloads in the required format. No hardcoded network endpoints are present, as the tool is designed to generate payloads for delivery to a target server by other means. The structure is typical for a Java Maven project, with a clear separation between exploit logic and supporting classes. The exploit is a proof-of-concept and requires the attacker to deliver the generated payload to a vulnerable ColdFusion server's AMF endpoint.

codewhitesecDisclosed Mar 12, 2018javaxmlnetwork
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
AdobeColdfusionapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app
+2 more in the timeline
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware4

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2017-3066
NVD
nvd.nist.gov/vuln/detail/CVE-2017-3066
MITRE CWE · CWE-502
Deserialization of Untrusted Data
Patch
helpx.adobe.com/security/products/coldfusion/apsb17-14.html
Third Party Advisory
exploit-db.com/exploits/43993
US Government Resource
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066