{"uuid": "7447c9aa-b067-4517-875d-22c9d7aab236", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29300", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/181", "content": "Adobe ColdFusion Pre-Auth RCE(s)\n\n\ud83d\udc64 by Rahul Maini,Harsh Jaiswal\n\nThe Adobe ColdFusion, widely recognized for its robust web development capabilities, recently\u00a0released\u00a0a critical security update. The update specifically targeted three security issues, among them,\u00a0CVE-2023-29300, a highly concerning pre-authentication Remote Code Execution (RCE) vulnerability. This vulnerability poses a significant threat, allowing malicious actors to execute arbitrary code on vulnerable Coldfusion 2018, 2021 and 2023 installations without the need for prior authentication.\n\nIn this blog post, author aims to provide a comprehensive analysis of CVE-2023-29300, shedding light on the nature of the vulnerabilities, and their potential impact, and sharing the journey of code review undertaken by his team.\n\n\ud83d\udcdd Contents:\n\u25cf Introduction\n\u25cf What's in the patch?\n\u25cf Parsing of WDDX Packet\n\u25cf Finding the Sink\n\u25cf Finding the Source\n\u25cf Escalating JNDI Injection To RCE\n\u25cf Updates\n\u25cf Conclusion\n\nhttps://blog.projectdiscovery.io/adobe-coldfusion-rce/", "creation_timestamp": "2023-07-20T05:53:03.000000Z"}