CVE-2017-3066
Published: 27 April 2017
Summary
CVE-2017-3066 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Adobe Coldfusion. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier contain a Java deserialization vulnerability (CWE-502) in the Apache BlazeDS library. The flaw carries a CVSS 3.1 score of 9.8 and permits unauthenticated remote code execution when untrusted data is deserialized.
An attacker with network access can supply a crafted serialized Java object to the affected BlazeDS endpoint without authentication or user interaction. Successful exploitation grants arbitrary code execution with the privileges of the ColdFusion process, resulting in full confidentiality, integrity, and availability impact on the server.
The Adobe security bulletin APSB17-14 at https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html addresses the issue and provides patch information for supported ColdFusion releases. Public exploit code for the vulnerability has been published on Exploit-DB.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-12207
Vulnerability details
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
- CWE(s)
- KEV Date Added
- 24 February 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation/sanitization of untrusted serialized input before deserialization, blocking the crafted Java object that triggers arbitrary code execution.
Mandates prompt application of vendor patches (APSB17-14) that eliminate the BlazeDS deserialization flaw in affected ColdFusion versions.
Enforces authentication and authorization checks on the BlazeDS endpoint so that unauthenticated network attackers cannot reach the vulnerable deserialization code path.