ColdFusion Exploit Used to Access Federal Agency

Unknown attackers exploited a known access control vulnerability in two Adobe ColdFusion application servers at a federal government agency in June, gaining access to the environment, uploading a webshell, and adding malicious code to the servers.

There were two separate incidents at the unnamed agency in June, and according to a new advisory from the Cybersecurity and Infrastructure Security Agency the attacks may be the work of one group or two separate groups. The intrusions appeared to be focused on …

access access control adobe adobe coldfusion advisory agency application attackers code coldfusion control environment exploit exploited federal federal agency federal government government government agency incidents june malicious servers vulnerability webshell