Securing your ColdFusion Server
by Michael Smith and David Schroeder
Security in ColdFusion
In this article we focus on what
ColdFusion security is and what steps you can take to secure your ColdFusion
Server. Utilizing these relatively
simple methods can make your ColdFusion Server a far more secure machine.
If you are not already familiar
with Allaire's ColdFusion, it is a
tag-based markup language (building on HTML,
or Hyper-Text Markup Language) that is used to write dynamic web pages. ColdFusion is currently on version 4.51,
with versions for Windows NT, 95, 98, Linux, and Solaris.
Securing a ColdFusion Server must
address three main issues; first you should secure the non-ColdFusion systems
such as the Operating System and the Network connection, second you should
secure the ColdFusion Server software, and lastly you should address security
within the ColdFusion code that runs on the Server. Particularly of issue is the security of the ColdFusion Server
software, the configuration of ColdFusion Server is critical to the security as
a whole. Here are some simple steps you can take to improve security right
Secure ColdFusion Server Configuration
Here are some tips for securing
your databases. To better isolate your machine from security hazards, store
your databases in separate directories from the root directory of your web
server, on separate drive, or if possible on a separate machine. Move your
databases from Microsoft Access to
the latest version Microsoft SQL Server or
Oracle, which are more secure and has
far better security features than Access.
Access is known to be unreliable under load, particularly with ODBC connectivity. If you must use Access, configure it in
ColdFusion Administrator to run with OLE
Database drivers instead of the standard ODBC drivers. OLE Database drivers will require the latest
Windows Database driver updates to your system (such as MDAC drivers). If you use
SQL Server, use User IDs and passwords that are difficult to guess, avoid short
or common words. Delete the guest and sa UserIDs from SQL server, which are default accounts on SQL
Install and run only those
services and applications you absolutely need on your ColdFusion Server,
unnecessary applications could potentially pose security risks and hurt
performance. Turn off or disable ColdFusion's RDS Service, which could also be a large security risk. Remove any
unused Custom Tags, such as CFX and CF tags, they potentially present a
security risk through misuse. If there are no HTML only (non-ColdFusion) files
in your directory, turn off read
access and only leave on execute
access to the directory. Maintain a log of all IP addresses and other pertinent
information on each page access using the CGI.REMOTE_ADDR
and CGI.HTTP_HOST variables. Logging detailed activity allows you to
roughly backtrack through a given user's activity on your site. If you are using Windows NT, create a new
Administrator account under a less common name instead of the guest and administrator accounts.
Having a secure Administrator
account is probably one of the most important issues covered in this
article. Only give the access rights
for read/update/delete, etc. that your application absolutely needs in SQL
server. Prevent sensitive data from
being accidentally exposed by using Stored
procedures in SQL Server and Oracle.
CFTRANSACTION prevents complex
database operations from only partially completing when an error occurs. Either use CFLOCK for read and write access of Application and Session
variables, or globally restrict all access to these variables to single threads
in ColdFusion Administrator. Remove the /CFDOCS/ directory that contains
potentially dangerous example code.
Turn off unnecessary tags in the
ColdFusion Administrator, such as CFDIRECTORY,
CFFILE, CFCONTENT, CFOBJECT, if
you are indeed not using them.
Generally the tags that can be disabled in the Administrator are
potentially dangerous to your server if exploited, for example unauthorized use
of the CFFILE tag could allow access
to any file on the server. Unused datasources from ColdFusion Administrator
should also be removed. Do not save
sensitive User IDs and passwords in ODBC datasource settings in Administrator,
instead use CFINCLUDE in code and
encrypt your code so that passwords cannot easily be exposed.
Although ColdFusion provides
Basic and Advanced Security facilities to prevent unauthorized use of
ColdFusion Administrator, Allaire strongly suggests two ways to secure access
to the Administrator at the file level. Use your Web Server’s file security to
protect the ColdFusion Administrator directory from outside web access. To do
this, edit your Web Server configuration to limit access to the directory /CFIDE/ADMINISTRATOR
from the web to those IP addresses that should have access. Additionally,
removing the directory from the web server when ColdFusion Administrator is not
in use can better ensure security.
Instability may occur unless
named CFLOCKs are around reads and
writes for sessions and applications.
Browsers retrieve pages with four to eight simultaneous threads, and it
is possible for two or more templates to try to write to the same user's
session variables. To avoid performance
issues stemming from the use of the locks, name the locks by concatenating the CFID and CFTOKEN values, thereby single-threading access to those variables
only for the one user in the one browser. Encrypt your ColdFusion source code
files (but save a backup copy first, just in case!) using CFCRYPT.EXE located in the /CFUSION/BIN directory. Bear in mind that no encryption is totally
secure, but that encrypting source code adds an extra line of defense. If you use ColdFusion Studio 4 or above,
when you upload a project it can encrypt your CF pages as it up loads them -
this avoids the problem of accidentally encrypting your only copy of the source
code! For pages that handle form submissions, test that the variable CGI.HTTP_REFERER really contains the URL
that you think it was submitted from, helping to prevent people submitting
outside form data. For example, the following code checks for the CGI.HTTP_REFERER to contain the correct
NOT CGI.HTTP_REFERER CONTAINS "the_correct_page.cfm">
Regularly apply all the latest
security fixes to Windows NT or Linux/Solaris and your Web Server software, new
patches and fixes are released on an almost daily basis. In the case of passing
numeric variables via URL, use val() to ensure that all you get is a number.
This prevents people adding SQL to the end of your URL variable, for example:
In the case of passing text
variables, enclose them in single quotes and do a check for single quotes in
the URL variable and generating an error message if found. Use Apache,
Internet Information Server, or O'Reilly WebSite directory security,
possibly with CFAuth too. Use a login form with the session.authorized variable in header as
below to restrict access from outside your intranet, that way you set the
session variable in a login page or other authorization mechanism and validate
in your header that it is properly defined.
For example, this would go in your application.cfm or header.cfm,
checking for your IP Address or session variable:
page = "#cgi.script_name#">
page contains "/intranet">
<CFIF left(CGI.REMOTE_ADDR,10) IS NOT
<!--- your subnet mask --->
<CFIF not isdefined("session.authorized")>
Sorry, you must login
<!--- message in case
CFLOCATION fails --->
<CFSET session.authorized =
protected links here.
Handling Errors properly
Handling ColdFusion errors in a
discrete way is another trick to better security for your ColdFusion
Server. Good error handling allows you
to control what is displayed to your users and how an application reacts to an
error. Make sure you restrict debugging
information to only the IP Addresses that absolutely require it, and when
working in a production environment, turn off debugging entirely. Debugging information displayed to the end
browser exposes potentially sensitive information, such as the names of SQL
databases and server information.
Record unexpected or uncommon errors to a custom log file you
create. For example:
LogFile = "d:\website\htdocs\logs\cferror.log">
output="The XXXXX error occurred at
Furthermore, when particularly
unexpected or alarming errors occur, you can set your error handler to notify
you via e-mail of the error, letting you know quickly of the error. For example:
GetProduct.recordcount IS 0>
error XXXXX, product not found
to="[email protected]" from="[email protected]"
subject="Error XXXXX occurred">
Warning! Error XXXXX occurred on your_page.cfm. Page was called from #cgi.HTTP_REFERER# from
remote address #cgi.REMOTE_ADDR#.
regular page operation here.
Use CFCATCH and CFTRY to
prevent ColdFusion's built in error handling from exposing system data. CFCATCH
and CFTRY are somewhat tricky to use
correctly and it is important to remember the basics of using them, such as:
The CFCATCH and CFTRY must be in the same page, you can
not put one in application.cfm or a header and the other in OnRequestEnd.cfm or
a footer, they should both reside in each page.
Errors in includes files will be caught. Errors in the
application.cfm and OnRequestEnd.cfm will NOT be caught - these pages require
their own separate error handling.
Error messages may occur in the middle an HTML table and so
may be not visible until you view the page source, keep an eye out for pages
that display incorrectly, this may be an indication of error.
Surround all code with CFCATCH
and CFTRY - any errors that occur
after the catch can not be caught!
Also, CFCATCH error
variables are different from the older CFERROR
If you get an error in your error handler you may not see any
error message on it!
Here is some sample code to get
you on your feet with good error handling:
your code here...
In the ErrorHandler.cfm put:
<!--- Log error to file --->
TO="[email protected]" FROM="[email protected]"
SUBJECT="Error on page
There was an error on
To Learn More
If you are interesting in learning more about ColdFusion
CPCUG and TeraTech are holding a free ColdFusion User Conference - CFUN-2K on
Saturday 7/29/2K and Sunday 7/30/2K at the Masur and Lipsett Auditoriums from
9am to 6pm. You can sign up for the conference at http://www.cfconf.org/ or call 301-424-3903.
You can download a free 30-day evaluation version of
ColdFusion from Allaire or request a free eval CD-ROM from the Allaire website http://www.allaire.com/
1 Alewife Center
Cambridge, MA 02140
Toll Free: 888.939.2545
Email: [email protected]
Allaire also maintain an extensive knowledge basis and
tech support forums on their website.
CPCUG and TeraTech ColdFusion Conference - CFUN-2K
a ColdFusion code cuttings called ColdCuts at http://www.teratech.com/ColdCuts/.
The Maryland ColdFusion User Group meets the second
Tuesday of each month in Rockville, MD.
See http://www.cfug-md.org/ for
details and directions.
The DC ColdFusion User Group meets the first Wednesday
each month. See the DCCFUG page on http://www.figleaf.com/
for details and directions.
Michael Smith is president of TeraTech, a ten year-old
Rockville, Maryland based consulting company that specializes in ColdFusion,
Database and Visual Basic development.
David Schroeder is a ColdFusion developer for TeraTech. You can reach
Michael or David at [email protected]