PT-2017-2027 · Apache+1 · Apache Blazeds+1

Faisal Tameesh · Published 2017-04-25 · Updated 2025-03-12 · CVE-2017-3066

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2016 Update 3 and earlier Adobe ColdFusion versions 11 update 11 and earlier Adobe ColdFusion versions 10 Update 22 and earlier

Description The issue is related to insufficient access control in the Apache BlazeDS library used by Adobe ColdFusion, which can lead to arbitrary code execution due to Java deserialization vulnerability. This can be exploited by a remote attacker. The vulnerability has been known since 2017 but still poses a threat to unpatched systems. It allows attackers to execute arbitrary code through HTTP requests due to an error in data processing. There have been instances where hackers have actively exploited similar vulnerabilities in Oracle Agile PLM, indicating a heightened interest in this product.

Recommendations For Adobe ColdFusion 2016 Update 3 and earlier, update to a version later than Update 3 to fix the Java deserialization vulnerability in the Apache BlazeDS library. For Adobe ColdFusion 11 update 11 and earlier, update to a version later than update 11 to fix the Java deserialization vulnerability in the Apache BlazeDS library. For Adobe ColdFusion 10 Update 22 and earlier, update to a version later than Update 22 to fix the Java deserialization vulnerability in the Apache BlazeDS library. As a temporary workaround, consider restricting access to the Apache BlazeDS library until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2017-01194

CVE-2017-3066

Affected Products

Coldfusion

Apache Blazeds

References · 24

• 🔥 https://github.com/codewhitesec/ColdFusionPwn · Exploit
• 🔥 https://exploit-db.com/exploits/43993 · Exploit
• 🔥 https://packetstormsecurity.com/files/146285/Adobe-Coldfusion-11.0.03.292866-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-3066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3066 · Security Note
• https://bdu.fstec.ru/vul/2017-01194 · Security Note
• https://twitter.com/transilienceai/status/1898342403288805832 · Twitter Post
• https://twitter.com/DMFezzaReed/status/1894075155728540108 · Twitter Post
• https://twitter.com/CISACyber/status/1894074061136798056 · Twitter Post
• https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html · Security Note, Vendor Advisory
• http://securityfocus.com/bid/98003 · Note
• https://twitter.com/bugbreport/status/1896840416693301481 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1894203785800556827 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066 · Note
• https://t.me/cvenotify/114515 · Telegram Post