CVE-2024-34112: Adobe ColdFusion Information Disclosure

CVE-2024-34112 Overview

CVE-2024-34112 is an Improper Access Control vulnerability [CWE-284] affecting Adobe ColdFusion versions 2023u7, 2021u13, and earlier. An unauthenticated attacker can exploit this flaw over the network to read arbitrary files from the underlying file system. Successful exploitation grants access to sensitive configuration files, credentials, and application data without any user interaction.

The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) and an EPSS score of 11.217% (93.6 percentile), indicating elevated exploitation likelihood. Adobe addressed the issue in the security bulletin APSB24-41.

Critical Impact

Remote unauthenticated attackers can read arbitrary files on vulnerable ColdFusion servers, exposing credentials, application source code, and sensitive configuration data.

Affected Products

• Adobe ColdFusion 2023 through Update 7 (2023u7)
• Adobe ColdFusion 2021 through Update 13 (2021u13)
• All earlier releases of ColdFusion 2021 and 2023

Discovery Timeline

• 2024-06-13 - CVE-2024-34112 published to NVD
• 2024-06-13 - Adobe releases security bulletin APSB24-41 with patches
• 2024-12-03 - Last updated in NVD database

Technical Details for CVE-2024-34112

Vulnerability Analysis

The vulnerability resides in ColdFusion's access control logic, which fails to properly restrict requests that resolve to files outside the intended application scope. An attacker crafts HTTP requests targeting ColdFusion endpoints that interact with the file system. The server processes these requests without validating whether the requesting principal holds authorization to read the targeted path.

The issue affects confidentiality only. Integrity and availability are not directly impacted, but the disclosed data routinely enables follow-on attacks. Recovered files often contain database credentials, datasource passwords stored in neo-datasource.xml, administrator hashes, and session tokens. Adversaries chain this read primitive with separate ColdFusion authentication or deserialization flaws to achieve full server compromise.

Adobe classified the root cause under [CWE-284: Improper Access Control], indicating missing or incorrect enforcement of authorization checks rather than a path traversal sanitization gap alone.

Root Cause

ColdFusion's request handler does not enforce access control on file references reachable through specific application endpoints. The server resolves file paths and returns content without verifying that the caller has rights to the resource. Default deployments expose the vulnerable handlers on the standard HTTP and HTTPS listeners.

Attack Vector

Exploitation requires only network reachability to the ColdFusion administrative or application interface. No credentials, user interaction, or local access are needed. An attacker sends a crafted HTTP request referencing a target file path. The server responds with the file contents, allowing iterative enumeration of the file system. Public exploit code is not currently confirmed, but the low complexity and unauthenticated nature of the flaw make weaponization straightforward.

Refer to the Adobe ColdFusion Security Advisory APSB24-41 for vendor-confirmed technical details.

Detection Methods for CVE-2024-34112

Indicators of Compromise

• HTTP requests to ColdFusion endpoints containing references to sensitive system paths such as /etc/passwd, WEB-INF/, cfusion/lib/neo-*.xml, or Windows paths like C:\ColdFusion\cfusion\lib\.
• Anomalous outbound responses from ColdFusion servers with unusually large body sizes returning non-HTML content.
• ColdFusion access logs showing repeated 200 OK responses to requests targeting administrative or CFIDE paths from a single external IP.
• Unexpected reads of password.properties, seed.properties, or datasource configuration files.

Detection Strategies

• Inspect ColdFusion access.log and web server logs for requests targeting file paths outside the standard application directory tree.
• Deploy web application firewall rules that flag URL parameters referencing absolute file paths or directory traversal sequences against ColdFusion endpoints.
• Hunt for process-level file reads by the coldfusion.exe or jrun.exe process accessing sensitive OS files outside the ColdFusion install directory.

Monitoring Recommendations

• Forward ColdFusion application, access, and exception logs to a centralized analytics platform for correlation against known exploitation patterns.
• Alert on first-seen external IPs issuing requests to administrative endpoints under /CFIDE/administrator/ and /cf_scripts/.
• Monitor egress traffic from ColdFusion hosts for exfiltration patterns immediately following suspicious file-read requests.

How to Mitigate CVE-2024-34112

Immediate Actions Required

• Apply Adobe ColdFusion 2023 Update 8 or ColdFusion 2021 Update 14 (or later) on every vulnerable host, as directed in APSB24-41.
• Inventory all internet-exposed ColdFusion instances and restrict administrative interfaces to trusted management networks only.
• Rotate all credentials, datasource passwords, and API keys stored on ColdFusion servers that were exposed prior to patching.
• Review logs for the 30 days preceding patch deployment for evidence of file-read exploitation.

Patch Information

Adobe published patched releases concurrently with security bulletin APSB24-41 on June 11, 2024. Administrators must install ColdFusion 2023 Update 8 or ColdFusion 2021 Update 14, then restart the ColdFusion application service. Adobe also recommends applying the latest JDK update supported for the ColdFusion release in use.

Workarounds

• Place ColdFusion behind a reverse proxy or WAF configured to block requests referencing absolute file paths or traversal patterns.
• Restrict access to /CFIDE/administrator and other administrative paths using network-level controls or IP allowlisting.
• Enforce the ColdFusion lockdown guide configuration to minimize the file system surface reachable by the ColdFusion service account.
• Run the ColdFusion service under a least-privileged account that cannot read sensitive operating system files.

# Configuration example: restrict ColdFusion admin paths at the web server tier
# Apache httpd example
<LocationMatch "^/(CFIDE/administrator|cf_scripts|CFIDE/adminapi)">
    Require ip 10.0.0.0/8 192.168.0.0/16
</LocationMatch>