Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

This strike exploits an insecure deserialization vulnerability in Adobe ColdFusion. The vulnerability is due to inadequate filtering of Java class paths during the deserialization process, allowing remote, unauthenticated attackers to send maliciously crafted serialized objects. These objects can lead to arbitrary code execution within the application. ColdFusion uses a denylist to prevent certain classes from being deserialized, however, the class com.sun.rowset.JdbcRowSetImpl was not blocked, which attackers exploited. Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the affected system.