Security
ColdFusion Configuration
dcepler
The previous sections focused on secure ColdFusion coding practices, but if the installation of ColdFusion is configured insecurely, all of that work is for nothing. Securing the ColdFusion Application Server requires making the OS, web server, and the ColdFusion configuration secure. Adobe has published Lockdown Guides for each version of ColdFusion:
- Adobe ColdFusion 2021 Lockdown Guide
- Adobe ColdFusion 2018 Server Lockdown Guide
- Adobe ColdFusion 2016 Server Lockdown Guide
- Adobe ColdFusion 11 Server Lockdown Guide
- Adobe ColdFusion 10 Server Lockdown Guide
- Adobe ColdFusion 9 Server Lockdown Guide
Commercial ColdFusion Security Tools
- Fixinator ColdFusion Code Security Scanner - scans your source code and alerts you to vulnerabilities.
- FuseGuard Web Application Firewall for CFML - runs inside your CFML application to log or block potentially malicious requests.
- HackMyCF CF Server Security Scanner - Scans your CF server on an automated basis to look for missing hotfixes or security misconfigurations.
Sandboxing
ColdFusion has had security sandboxing for quite a long time, but is probably an under utilized option that can help secure ColdFusion because it is only really useful in Enterprise. Sandboxing allows you to restrict access to data sources, ColdFusion tags/functions, directories, and servers/ports on a subdirectory. If a piece of ColdFusion code tries to access a restricted resource in the sandbox, ColdFusion will throw an error. The best use of sandboxing is to restrict everything on the webroot of a server and then only allow what is needed per the subdirectory (web application).
Additional Resources:
More Resources
Websites
- ColdFusion Developer Security Guide - written for CF11
- Security improvements in ColdFusion 10
- The Open Web Application Security Project
Books
- The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws, Second Edition by Dafydd Stuttard and Marcus Pinto
- SQL Injection Attacks and Defense, Second Edition by Justin Clarke
- XSS Attacks: Cross Site Scripting Exploits and Defense by Jeremiah Grossman, Robert "RSnake" Hansen, Petko "pdp" D. Petkov and Anton Rager