Adobe ColdFusion convertToTemplateProxy Insecure Deserialization

This strike exploits an insecure deserialization vulnerability in Adobe ColdFusion. The vulnerability is due to deserialization of untrusted data when processing HTTP parameters sent to ColdFusion Component (CFC) endpoints. A remote, unauthenticated, attacker could exploit this vulnerability by injecting crafted CFML tags into logs and then trigger the exploit by requesting the log file. Successful exploitation could result in arbitrary code execution in the security context of SYSTEM.