Detection: Adobe ColdFusion Unauthenticated Arbitrary File Read

Updated Date: 2026-03-27 ID: 695aceae-21db-4e7f-93ac-a52e39d02b93 Author: Michael Haag, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. It monitors POST requests to the "/cf_scripts/scripts/ajax/ckeditor/*" endpoint using the Web datamodel. This activity can be significant due to the vulnerability's high CVSS score of 9.8, indicating severe risk. If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Web WHERE
 7
 8Web.url="*/cf_scripts/scripts/ajax/ckeditor/*"
 9Web.status=200
10Web.http_method=POST
11
12BY Web.http_user_agent Web.status Web.http_method
13   Web.url Web.url_length Web.src Web.dest
14
15
16| `drop_dm_object_name("Web")`
17
18| `security_content_ctime(firstTime)`
19
20| `security_content_ctime(lastTime)`
21
22| `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`

Data Source

Name	Platform	Sourcetype	Source
Suricata	Other	`'suricata'`	`'not_applicable'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
adobe_coldfusion_unauthenticated_arbitrary_file_read_filter	`search *`

adobe_coldfusion_unauthenticated_arbitrary_file_read_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

CVE-2023-26360

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.

Known False Positives

In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. These include:

"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo"
"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/2U9Uyvv qwP4PGaZpjARz5VJGfpCk.jsp"
"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm"

These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.

Associated Analytic Story

Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360

Risk Based Analytics (RBA)

Risk Message:

Possible exploitation of CVE-2023-26360 against $dest$ via $url$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	20	src

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`suricata`
Integration	✅ Passing	Dataset	`not_applicable`	`suricata`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 8