CVE-2023-29298

CVE-2023-29298 is a critical vulnerability found in Adobe ColdFusion, an application server used for building and deploying web and mobile applications. This flaw, discovered by Rapid7, was part of multiple Common Vulnerabilities and Exposures (CVEs) affecting Adobe ColdFusion in July 2023. The vulnerability allows threat actors to bypass authentication, remotely execute commands, and install webshells on vulnerable servers. On July 11, 2023, Adobe released patches to address this access control bypass vulnerability along with other vulnerabilities including an insecure deserialization vulnerability allowing arbitrary code execution (CVE-2023-29300). Active exploitation of CVE-2023-29298 was detected on July 13, 2023, alongside another unpublished vulnerability tracked as CVE-2023-38203. This discovery indicated that threat actors were leveraging these vulnerabilities to compromise systems. In an unfortunate turn of events, Project Discovery mistakenly disclosed an n-day exploit for what they believed to be CVE-2023-29300, but Adobe quickly responded by releasing an out-of-band update to fix the issue on July 14. In response to the ongoing threats, Adobe released security updates last week to address three high-risk vulnerabilities: CVE-2023-29298, CVE-2023-29300, and CVE-2023-29301. These updates are crucial for enhancing system security and mitigating potential risks associated with these vulnerabilities. It is recommended that users promptly apply these updates to their systems to protect against possible exploitation.