### [CVE-2017-3066](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3066)
![](https://img.shields.io/static/v1?label=Product&message=Adobe%20ColdFusion%20ColdFusion%202016%20Update%203%20and%20earlier%2C%20ColdFusion%2011%20update%2011%20and%20earlier%2C%20ColdFusion%2010%20Update%2022%20and%20earlier&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brighgreen)

### Description

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

### POC

#### Reference
- https://www.exploit-db.com/exploits/43993/

#### Github
- https://github.com/20142995/pocsuite
- https://github.com/6point6/vulnerable-docker-launcher
- https://github.com/ARPSyndicate/cvemon
- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- https://github.com/BrittanyKuhn/javascript-tutorial
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
- https://github.com/HimmelAward/Goby_POC
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
- https://github.com/Pocm0n/Web-Coldfusion-Vulnerability-POC
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Threekiii/Awesome-Exploit
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Z0fhack/Goby_POC
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/codewhitesec/ColdFusionPwn
- https://github.com/cucadili/CVE-2017-3066
- https://github.com/depthsecurity/coldfusion_blazeds_des
- https://github.com/klausware/Java-Deserialization-Cheat-Sheet
- https://github.com/koutto/jok3r-pocs
- https://github.com/lnick2023/nicenice
- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/t0m4too/t0m4to
- https://github.com/tanjiti/sec_profile
- https://github.com/xbl3/awesome-cve-poc_qazbnm456