Adobe has released emergency security updates to address a critical ColdFusion vulnerability, for which PoC exploit code has also been released.
The vulnerability tracked as CVE-2024-53961 is caused by a path traversal weakness that affects versions 2023 and 2021 of Adobe ColdFusion and could allow attackers to read files on vulnerable servers.
Adobe warned customers about the severity of the vulnerability (“Priority 1”).
See also: Cloud Atlas hackers use Microsoft Office vulnerability to distribute backdoors
The company advises administrators to install the new emergency updates security (ColdFusion 2021 Update 18 and ColdFusion 2023 Update 12) as soon as possible and to implement the security configuration settings described in the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Adobe has not disclosed whether this ColdFusion vulnerability has already been used in attacks, but advised customers to check the updated serial filter documentation for more information on blocking unsafe Wddx deserialization attacks.
As CISA warned in May, attackers can exploit path traversal vulnerabilities to gain access to sensitive data, including credentials that can be used in attacks.
See also: Critical vulnerabilities in SHARP routers – Update immediately!
Last year, in July 2023, CISA also ordered federal agencies to secure Adobe ColdFusion servers by August 10 against two other critical vulnerabilities (CVE-2023-29298 and CVE-2023-38205) that were being used in attacks.
Protection
For your protection, Adobe recommends upgrading to the latest available version of ColdFusion. Regular security updates for Adobe ColdFusion are critical. Failure to install these updates can leave your system vulnerable to attacks and security breaches.
Additionally, experts recommend implementing network segmentation, using a firewall or WAF, and enforcing signed software execution policies.
See also: Siemens UMC vulnerability allows arbitrary code execution
You also need to properly configure your ColdFusion server. This includes disabling unnecessary services and features.
Finally, it is important to implement strict security policies and regularly monitor logs for signs of unwanted activity.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: www.bleepingcomputer.com
