Loading vulnerability…
CVE-2024-20767 is an improper access control vulnerability in Adobe ColdFusion that affects ColdFusion 2023 Update 6 and earlier and ColdFusion 2021 Update 12 and earlier. The flaw can be exploited without user interaction and allows an unauthenticated attacker to perform arbitrary file system reads when the ColdFusion administrator interface is exposed to the internet. Successful exploitation can disclose restricted server-side files, including sensitive ColdFusion configuration material, indicating that access controls protecting administrative file access are insufficiently enforced.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python exploit script (CVE-2024-20767.py) targeting Adobe ColdFusion servers vulnerable to CVE-2024-20767. The exploit works in two stages: first, it sends a request to the '/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat' endpoint to obtain a UUID from the server. Then, it uses this UUID in a header to send a second request to the '/pms' endpoint, exploiting a directory traversal vulnerability to read arbitrary files from the server. The script requires the attacker to specify the target server's address, port (default 8500), and the file path to read. The repository also includes a minimal README. The exploit is operational and demonstrates the ability to read files from a vulnerable ColdFusion server over the network.
This repository contains a single Metasploit auxiliary module targeting CVE-2024-20767, an arbitrary file read vulnerability in Adobe ColdFusion (versions prior to 2023 Update 6 and 2021 Update 12). The module works by first obtaining a UUID from the /CFIDE/adminapi/_servermanager/servermanager.cfc endpoint, then using that UUID to access the /pms endpoint with a crafted file_name parameter that leverages directory traversal to read arbitrary files from the server. The exploit is unauthenticated and network-based, requiring only access to the vulnerable endpoints. The module is written in Ruby and is structured as a typical Metasploit auxiliary module, with options for the target URI, file path to read, number of lines, and traversal depth. The exploit saves the retrieved file contents as loot within Metasploit. No fake or detection-only code is present; this is a functional exploit module.
This repository contains a Python proof-of-concept exploit for CVE-2024-20767, an arbitrary file read vulnerability in Adobe ColdFusion (2023 Update 6 and earlier, 2021 Update 12 and earlier). The exploit works in two stages: it first retrieves a UUID from the vulnerable endpoint '/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat', then uses this UUID in a header to access the '/pms' endpoint with a crafted 'file_name' parameter to read arbitrary files from the server's file system. The exploit is executed via command line, requiring the target server's URL, port, and the file path to read. The repository includes a README with usage instructions, affected product versions, and references. The main exploit capability is remote, unauthenticated arbitrary file read via network requests to specific ColdFusion endpoints.
This repository provides a Python-based exploit for CVE-2024-20767, a critical arbitrary file read vulnerability in Adobe ColdFusion 2023 (Update 6 and earlier) and 2021 (Update 12 and earlier). The exploit consists of a main script (exploit.py), a requirements file, and a README.md with detailed usage instructions. The exploit works by first retrieving a UUID from a ColdFusion server endpoint, then using that UUID to send crafted requests to another endpoint that allows reading arbitrary files from the server's file system. The script supports scanning single URLs or lists of targets, and writes results to an output file. The attack vector is network-based, requiring HTTP(S) access to the target server. The endpoints targeted are specific ColdFusion administrative and logging modules. The exploit is a proof-of-concept and does not provide post-exploitation payloads beyond file read capability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity Adobe ColdFusion vulnerability requiring the administrator panel to be exposed to the internet, used for arbitrary file read and credential extraction from configuration files.
A previous Adobe ColdFusion arbitrary file read vulnerability that was actively exploited in the wild.
An Adobe ColdFusion improper access control vulnerability that could allow unauthorized access/modification of restricted resources.
An arbitrary file read vulnerability in Adobe ColdFusion, allowing attackers to read sensitive files from the server.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.