Adobe ColdFusion: Deserialization RCE (CVE-2023-26360)

Before the attacker dropped anything onto this server, they leveraged a well-documented flaw in ColdFusion to reach a path that should never accept external requests. Identify that vulnerable endpoint URI -- the path that was the first target of the exploit POST requests.

Two distinct external addresses were involved in this intrusion: one sent the exploit payloads and another operated the webshell afterward. Pinpoint the address responsible for the initial exploitation and the credential file read.

The RCE payload did not just read data -- it wrote a new file to the web root that gave the attacker persistent command execution on the server. Identify the filename of the page that was planted.

Receiving requests to a webshell page is suspicious; a child process spawned by the application JVM is conclusive. Identify the MITRE ATT&CK sub-technique that describes command execution through a web-accessible script or template on a server.

After establishing command execution on the ColdFusion server, the attacker used the compromised service account to reach a second host inside the trusted network. Identify the internal IP address of that second system.

Data did not stay on the network. The webshell used ColdFusion's own HTTP client capability to push harvested content to an external staging server. Name the domain that received the exfiltrated data.