The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently raised an alarm regarding a critical vulnerability within Adobe ColdFusion, known as CVE-2023-26360, being actively exploited by hackers to infiltrate government servers.
This security loophole enabled threat actors to execute arbitrary code on servers running older versions of Adobe ColdFusion—specifically, ColdFusion 2018 Update 15 and earlier, and 2021 Update 5 and prior. The vulnerability, initially exploited as a zero-day, prompted Adobe’s response with the release of ColdFusion 2018 Update 16 and 2021 Update 6 in mid-March to rectify the issue.
CISA’s initial advisory urged federal and state organizations to promptly apply the security updates following Adobe’s fix, aiming to thwart exploitation attempts of the vulnerability. In a recent alert, the U.S. Cyber Defense Agency reported ongoing exploits of CVE-2023-26360, highlighting incidents from June that affected two federal agency systems. The agency emphasized that both compromised servers were operating on outdated software versions, rendering them vulnerable to various CVEs, including the one exploited in these incidents.
The detailed accounts of the breaches narrate distinct attack methodologies employed by the hackers. In one instance on June 26, a server running Adobe ColdFusion v2016.0.0.3 fell victim to the exploit. The attackers maneuvered through process enumeration, network checks, and installation of a web shell, enabling them to infiltrate configuration files, extract credentials, and execute operations within the system.
Similarly, on June 2, the hackers exploited the vulnerability on a server running Adobe ColdFusion v2021.0.0.2. This time, they gathered user account information, deployed a text file operating as a remote access trojan, and attempted to access critical Registry files and security account manager data. Although the attacks were detected and thwarted before data exfiltration or lateral movement occurred, the aggressors engaged in file deletion to conceal their actions and facilitate further malicious operations.
CISA’s analysis characterized these incidents as reconnaissance activities, raising uncertainty regarding the correlation between the intrusions and the identity of the threat actor orchestrating these breaches.
To mitigate such risks, CISA recommends a series of protective measures, including promptly upgrading ColdFusion to the latest version, implementing network segmentation, deploying firewalls or Web Application Firewalls (WAF), and enforcing policies for signed software execution. These measures aim to fortify defenses against potential exploitation attempts and bolster overall system security.
Preventing further exploitation of the CVE-2023-26360 vulnerability in Adobe ColdFusion necessitates immediate action and a comprehensive security strategy. Organizations should prioritize updating their ColdFusion servers to the latest versions—ColdFusion 2018 Update 16 and 2021 Update 6—to patch the critical vulnerability. Simultaneously, implementing robust network segmentation, deploying firewalls or Web Application Firewalls (WAF), and enforcing strict policies for signed software execution can erect formidable barriers against potential infiltration attempts.
