CISA details twin attacks on federal servers via unpatched ColdFusion flaw

CISA has released details about a federal agency that recently had at least two public-facing servers compromised by attackers exploiting a critical Adobe ColdFusion vulnerability. The vulnerability, tracked as CVE-2023-26360, was disclosed in March and was shortly after added to CISA's known exploited vulnerability (KEV) catalog, setting an April 5 deadline for agencies to fix the issue. In a Tuesday advisory, CISA revealed the federal civilian executive branch (FCEB) in question was successfully attacked in June and into July, meaning the vulnerability went unpatched for more than three months after CISA's deadline. CISA did not respond to questions about whether the agency has now patched the vulnerability, who was behind the attack, or its stance on the missed deadline. Analysis of logs revealed the two servers identified as compromised were attacked in what appears to be two separate attacks. In both cases, the servers were running outdated versions of the web app development platform and were vulnerable to various CVEs, CISA said. "Additionally, various commands were initiated by the threat actors on the compromised web servers; the exploited vulnerability allowed the threat actors to drop malware using HTTP POST commands to the directory path associated with ColdFusion." The cybersecurity agency is unable to confirm whether data was stolen by the intruders in either incident. It's believed both campaigns were designed as reconnaissance efforts to understand the broader...