CVE-2026-48282-coldfusion-rds-detection

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS with arbitrary CFM file write, code execution, auditd/PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes English and Polish reports.

Repository structure

No exploit source, payload source, CFM payload, raw PCAP, or raw host evidence package is included.

Test environment

The ColdFusion application directory /app was mapped from the Ubuntu host path /home/user/coldfusion-u9/app as a Docker bind mount.

What was validated

The test was performed in an isolated and authorized laboratory environment. The validation covered the following sequence:

1. Adobe ColdFusion 2025 Update 9 was deployed in Docker.
2. RDS was enabled for the laboratory test, with the authentication mode set to No authentication needed.
3. The public project listed in References was used to confirm that the RDS endpoint was reachable and that the tested instance appeared vulnerable.
4. A laboratory-only uploader was used to submit a CFM file through the RDS FILEIO operation to /app/connect.cfm.
5. The file was invoked through GET /connect.cfm.
6. ColdFusion launched /bin/bash through the Java process execution path.
7. The shell established an outbound TCP connection to the Windows workstation.
8. Non-destructive discovery commands were executed to confirm the effective user, operating system, and working directory.
9. Evidence from the attacker and victim systems was correlated into a single UTC timeline.

The reports intentionally document the evidence and detection logic without distributing the custom uploader or payload implementation.

Confirmed result

The laboratory test confirmed:

• arbitrary CFM file write through the RDS FILEIO endpoint in the tested configuration;
• execution of the written CFM file by ColdFusion after an HTTP request;
• creation of the process chain:

• an outbound shell connection from the ColdFusion container to the Windows host;
• execution in the context of the ColdFusion service user, not as root.

Inside the container, the effective identity was:

On the Ubuntu host, UID 999 was resolved using the host account database as dnsmasq, which explains the different username shown in host-level auditd records and file ownership output.

Key evidence

RDS configuration

The administrative configuration used for the test is shown below. The No authentication needed option was enabled only for the controlled laboratory validation.

Initial vulnerability check

The initial check confirmed that the RDS endpoint was reachable and reported arbitrary file read/write behavior through path traversal.

CFM file write

The laboratory uploader submitted the local CFM test artifact to /app/connect.cfm. The server returned the RDS response 1:2:XX, and the written resource was subsequently reachable over HTTP.

Code execution and service-account context

The resulting shell session confirmed execution as the ColdFusion service account. The commands shown in the screenshot were limited to environment identification.

File on the Ubuntu bind mount

The file appeared in /home/user/coldfusion-u9/app, the host path mounted into the container as /app.

Reconstructed timeline

The complete timeline is available in both PDF reports. The most important events were:

Evidence collection methodology

Linux and Docker

The victim host collected:

• auditd events for execve, execveat, and connect where the effective UID was 999;
• watches on the ColdFusion webroot and log directory;
• tcpdump traffic for the HTTP and callback ports;
• periodic process and socket snapshots;
• Docker container metadata, logs, events, process listings, and filesystem differences;
• ColdFusion application and administrative logs;
• SHA-256 hashes and metadata baselines.

The final auditd status reported lost=0, indicating that the kernel audit subsystem did not report dropped events during the captured test window.

Windows

The attacker workstation collection was intentionally limited to report-relevant artifacts:

• operating-system and network details;
• Event ID 4688 process creation records;
• processes associated with Python and Ncat;
• relevant TCP connection data;
• hashes of laboratory files;
• Microsoft Defender status and detections;
• tool versions.

Most important detection opportunities

1. RDS FILEIO request

Monitor HTTP, reverse-proxy, WAF, or network telemetry for the following combination:

The combination is significantly stronger than any single indicator by itself.

2. File write followed by execution

Correlate:

1. a FILEIO WRITE request to a server-executable extension;
2. a subsequent GET request to the newly written resource;
3. a new child process of ColdFusion Java or jspawnhelper within a short time window.

3. Suspicious ColdFusion child process

High-value process indicators include:

Additional command-line indicators include /dev/tcp, interactive shell flags, redirection operators, encoded commands, and unexpected use of cfexecute.

4. Outbound connection from the application service account

Alert when a shell or interpreter launched by ColdFusion initiates an outbound connection to a workstation or an unusual destination port. The laboratory event used TCP port 4444, but production detection should not depend on a single port.

5. RDS configuration changes

Monitor ColdFusion administrative logs for messages containing:

Any RDS configuration change in production should be reviewed, particularly when authentication is weakened or the service becomes reachable from additional networks.

6. Application-directory file monitoring

The test identified an important container-monitoring limitation: /app was a bind mount. docker diff showed /app but did not provide complete visibility into individual files created inside the host-mounted directory.

File-integrity monitoring, auditd, eBPF, or EDR coverage should therefore monitor the real host path backing the mount, for example:

Monitoring only the container overlay or /opt/coldfusion/cfusion/wwwroot would not have captured the complete file-creation evidence for this test.

SOC triage guidance

When the HTTP indicator is detected, the SOC should immediately correlate it with:

• the source IP and user agent;
• RDS authentication and exposure configuration;
• the target path contained in the FILEIO body;
• new or modified .cfm, .cfc, .jsp, or archive files;
• HTTP access to the same file shortly after creation;
• ColdFusion Java child processes;
• outbound connections from the service account;
• subsequent discovery commands such as whoami, id, uname, hostname, pwd, ip, ifconfig, netstat, or ss;
• persistence attempts, credential access, or lateral movement after the initial process execution.

A single GET request to a CFM file is not sufficient on its own. The strongest alert combines file-write, file-access, process-creation, and network-connection telemetry within the same short time window.

Recommended mitigations

1. Apply the Adobe ColdFusion security update referenced in APSB26-68.
2. Disable RDS when it is not operationally required.
3. If RDS must remain enabled, enforce authentication and restrict access to explicitly authorized administrative systems.
4. Prevent RDS and CFIDE administrative endpoints from being exposed to untrusted networks.
5. Monitor and restrict writes to directories from which ColdFusion can execute server-side content.
6. Limit the ability of the ColdFusion service account to launch operating-system processes where business functionality does not require it.
7. Monitor the host paths behind Docker bind mounts, not only the container overlay filesystem.
8. Review the environment for unexpected CFM/CFC/JSP files and ColdFusion-launched shells.

Scope and limitations

• The validation was performed against one ColdFusion 2025 Update 9 Docker instance.
• RDS was deliberately configured as No authentication needed for the controlled test.
• The observed impact was code execution as the ColdFusion service account; no privilege escalation to root was observed.
• The result confirms the tested path and configuration. It does not prove that every deployment, authentication mode, reverse proxy, or operating system behaves identically.
• Raw exploit code, the custom uploader, and the CFM payload are not distributed in this repository.
• The reports contain selected evidence excerpts rather than full raw logs, to keep the material readable and focused on detection.

References

• Adobe Security Bulletin APSB26-68
• NVD — CVE-2026-48282
• CVE.org — CVE-2026-48282
• Public project used as the initial validation reference

Responsible-use notice

This material is provided for defensive security research, vulnerability management, detection engineering, incident-response preparation, and authorized testing. Do not use it against systems without explicit permission.