ColdFusion Security Threats - Revision history

Jakeh at 19:05, 23 April 2014

2014-04-23T19:05:37Z

2013-12-20T00:03:04Z

‎Securing ColdFusion on Apache httpd

2013-12-20T00:02:49Z

‎Securing ColdFusion on Apache httpd

2013-12-20T00:00:01Z

‎Securing ColdFusion on Apache httpd

2013-12-19T23:59:15Z

2013-01-04T19:47:25Z

‎Steps to protect your server

2013-01-04T19:45:29Z

2013-01-04T19:28:45Z

‎Steps to protect your server

2013-01-04T19:15:34Z

‎2013/01/04 Scheduler Vulnerability

2013-01-04T18:57:55Z

@@ Line 1: / Line 1: @@
 Details and resolutions for ColdFusion security threats.
-==2013-01-04 Scheduler Vulnerability==
+==2013-01-04 ColdFusion Scheduler Vulnerability==
 This vulnerability allows a remote attacker to schedule a ColdFusion task that saves the result into a '''.cfm''' file.  The resulting '''.cfm''' file is then used by the attacker to compromise the system.
@@ Line 64: / Line 64: @@
 Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/ your actual IP address]. Once finished, save the file then restart Apache httpd.
 [[Category:ColdFusion-VPS]]

@@ Line 63: / Line 63: @@
 </LocationMatch></pre>
-Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/|your actual IP address]. Once finished, save the file then restart Apache httpd.
+Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/ your actual IP address]. Once finished, save the file then restart Apache httpd.
 [[Category:ColdFusion-VPS]]

@@ Line 63: / Line 63: @@
 </LocationMatch></pre>
-Be sure to replace '''123.213.132.231''' with your [https://hostek.com/ip/|your actual IP address]. Once finished, save the file then restart Apache httpd.
+Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/|your actual IP address]. Once finished, save the file then restart Apache httpd.
 [[Category:ColdFusion-VPS]]

@@ Line 63: / Line 63: @@
 </LocationMatch></pre>
-Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/|your actual IP address]. Once you make the changes save the file, and restart Apache httpd.
+Be sure to replace '''123.213.132.231''' with your [https://hostek.com/ip/|your actual IP address]. Once finished, save the file then restart Apache httpd.
 [[Category:ColdFusion-VPS]]

← Older revision		Revision as of 23:59, 19 December 2013
Line 36:		Line 36:
	The request filtering module is configured to deny the URL sequence		The request filtering module is configured to deny the URL sequence

		+	===Securing ColdFusion on Apache httpd===
		+	If you run Apache (httpd) instead of IIS, then you secure access to ColdFusion by adding the following to your Apache configuration file (httpd.conf or http.conf):
		+	<pre>
		+	<LocationMatch "/CFIDE/administrator/">
		+	order deny,allow
		+	deny from all
		+	#allow from local and your IP
		+	allow from 127.0.0.1
		+	allow from 123.213.132.231
		+	</LocationMatch>
		+
		+	<LocationMatch "/CFIDE/adminapi">
		+	order deny,allow
		+	deny from all
		+	#allow from local and your IP
		+	allow from 127.0.0.1
		+	allow from 123.213.132.231
		+	</LocationMatch>
		+
		+	<LocationMatch "/CFIDE/componentutils">
		+	order deny,allow
		+	deny from all
		+	#allow from local and your IP
		+	allow from 127.0.0.1
		+	allow from 123.213.132.231
		+	</LocationMatch></pre>
		+
		+	Be sure to replace '''123.213.132.231''' with [https://hostek.com/ip/\|your actual IP address]. Once you make the changes save the file, and restart Apache httpd.
	[[Category:ColdFusion-VPS]]		[[Category:ColdFusion-VPS]]

← Older revision		Revision as of 19:47, 4 January 2013
Line 31:		Line 31:


−	After the script is successfully executed, you should test accessing the '''/CFIDE/administrator/''' directory from underneath one of your websites (example: '''http://yourdomain.com/CFIDE/administrator/index.cfm'''). You should receive an error similar to the following:	+	After the script is successfully executed, you should test accessing the '''/CFIDE/administrator/''' directory from underneath one of your websites (example: '''<nowiki>http://yourdomain.com/CFIDE/administrator/index.cfm</nowiki>'''). You should receive an error similar to the following:

	HTTP Error 404.5 - Not Found		HTTP Error 404.5 - Not Found

← Older revision		Revision as of 19:28, 4 January 2013
Line 17:		Line 17:
	This vulnerability is only possible if the remote attacker can access the '''/CFIDE/administrator/''' or '''/CFIDE/adminapi/''' directories.		This vulnerability is only possible if the remote attacker can access the '''/CFIDE/administrator/''' or '''/CFIDE/adminapi/''' directories.

−	The following batch script ('''Requires IIS7 or above''') disables access to those folders using the '''Request Filtering''' module in IIS. This script assumes that you have a site named '''CFAdmin''' with restricted access that you will use to access the ColdFusion Administrator. For ColdFusion VPS servers configured by Hostek, that site should already exist and have IP Restrictions preventing unauthorized access. After you run this script, that site will be the only point of entry into the ColdFusion Administrator.	+	The following batch script ('''Requires IIS7 or above''') disables access to those folders using the '''Request Filtering''' module in IIS. This script assumes that you have a site named '''CFAdmin''' with restricted access that you will use to access the ColdFusion Administrator. The '''CFAdmin''' site will be excluded from the URL restrictions. For ColdFusion VPS servers configured by Hostek, that site should already exist and have IP Restrictions preventing unauthorized access. After you run this script, that site will be the only point of entry into the ColdFusion Administrator.

@@ Line 3: / Line 3: @@
 ==2013/01/04 Scheduler Vulnerability==
-This vulnerability allows a remote attacker to schedule a ColdFusion task, which saves the result into a '.cfm' file which can then be used by the attacker to compromise the system.
+This vulnerability allows a remote attacker to schedule a ColdFusion task that saves the result into a '''.cfm''' file.  The resulting '''.cfm''' file is then used by the attacker to compromise the system.
 ===Details===

← Older revision		Revision as of 18:57, 4 January 2013
Line 1:		Line 1:
−	Details on resolutions for ColdFusion security threats.	+	Details and resolutions for ColdFusion security threats.

	==2013/01/04 Scheduler Vulnerability==		==2013/01/04 Scheduler Vulnerability==