CVE-2017-3066

This repository contains a functional exploit for CVE-2017-3066, targeting Adobe ColdFusion 11/12. It leverages deserialization vulnerabilities by generating serialized AMF payloads using ysoserial gadgets, enabling remote code execution.

This repository provides a detailed writeup and analysis of CVE-2017-3066, a Java deserialization vulnerability in Adobe ColdFusion's Apache BlazeDS library. It includes vulnerable/updated version comparisons, installation/exploitation references, and Suricata detection rules.

This exploit leverages a Java object deserialization vulnerability in Adobe ColdFusion's BlazeDS component to achieve remote code execution. It sends a crafted AMF payload to trigger a JRMP connection to a listener for secondary payload delivery.