Adobe ColdFusion 11 Security Technical Implementation Guide
| Version 1 Release 4 |
| 2018-01-26 |
| U_Adobe_ColdFusion_11_STIG_V1R4_Manual-xccdf.xml |
| This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil. |
Vulnerabilities (100)
ColdFusion must limit concurrent sessions to the Administrator Console.
Discussion
The ColdFusion Administrator Console is used to manage the ColdFusion application server. The console allows a user to configure settings used by hosted applications, maintain connections to external resources, review logs, etc. By disallowing concurrent logons, a user has a method to determine if his account has been comprised (The user will be unable to log into the Administrator Console.) and deters a user from having an open idle session from different work stations which can also be used by an attacker.
Fix Text
Within the Administrator Console, navigate to the "Administrator" settings under the "Security" menu. To disable concurrent logins, uncheck the "Allow concurrent login sessions for Administrator Console" setting and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Administrator" settings under the "Security" menu. If the setting "Allow concurrent login sessions for Administrator Console" is checked, this is a finding.
ColdFusion must use cryptography mechanisms to protect the integrity of data sent to the PDF Service.
Discussion
Protecting data being sent to the PDF Service for PDF document creation protects the data from being read or modified before the document is created and returned to the requesting application. This protection can be implemented by using https over the plaintext transport protocol of http.
Fix Text
If there are no PDF Service Managers in use, the finding is not applicable. Access the "PDF Service" page under the "Data & Services" menu within the Administrator Console. Edit each service and check the "Https Enabled" option.
Check Content
Access the "PDF Service" page under the "Data & Services" menu within the Administrator Console. If there are no PDF Service Managers defined, the finding is not applicable. If any PDF Service Managers listed have "Https Enabled" set to "NO", this is a finding.
ColdFusion must implement cryptography mechanisms to protect the integrity of the remote access session.
Discussion
Protecting the data by not allowing unsecure non-FIPS 140-2 modules to be used and forcing FIPS 140-2 approved encryption modules limits the attack vector for an attacker. Several attacks, such as the POODLE attack and variants of the POODLE attack, take advantage of forcing an https communication to back down to an unsecure encryption module allowing the attacker to then read the encrypted data.
Fix Text
Navigate to the "JVM arguments" setting within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. Add the parameter -Dhttps.protocols and set the parameter to the TLS versions to be used. A sample setting to use TLSv1.2, TLSv1.1 and TLSv1 is - Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1. SSL versions must not be added to this parameter. Once the parameter is added to the JVM arguments, select the "Submit Changes" button to save the changes and restart the ColdFusion application server to have the changes take effect.
Check Content
Review the setting "JVM arguments" within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. The parameter -Dhttps.protocols is used to set the TLS versions that the JVM can use. Valid values for this setting must be TLS versions 1.0 or higher. An example setting to use TLS versions 1.2, 1.1 and 1.0 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 and an example to only use TLS version 1.2 is -Dhttps.protocols=TLSv1.2 If the "JVM arguments" setting does not contain the parameter -Dhttps.protocols or if the parameter -Dhttps.protocols contains any SSL versions, this is a finding.
ColdFusion must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Discussion
Controlling what a user can see or change is important within the ColdFusion application server. Allowing non-privileged users to change administrative type data can cause errors within the system or DoS situations. By forcing users to identify themselves and then tying roles to that identity, an individual is presented with only those options needed to perform their duties.
Fix Text
Navigate to the "User Manager" page under the "Security" menu and review the roles assigned to each user. Enable only those roles for each user approved by the ISSO/ISSM.
Check Content
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review the roles assigned to each user against the ISSM approved list of user accounts and roles to determine if any user has excessive authorization. If any user has roles assigned that are not approved by the ISSM, this is a finding.
ColdFusion must automatically terminate a user session after user inactivity.
Discussion
An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwart the vulnerability of open and unused user sessions, the application server must be configured to close the sessions when a configured condition or trigger event is met. Such an event is user inactivity. ColdFusion offers an inactivity parameter that allows the setting of a system-wide timeout for sessions. If this parameter is set too large, the usefulness of the parameter is lost. Care must be taken to not allow sessions to be open longer than needed, but also not set so short that users are unable to use the hosted applications.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the "Session Variables" setting under the "Default Timeout" section to 15 minutes or less and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If the "Session Variables" setting under the "Default Timeout" section is set greater than 15 minutes, this is a finding.
ColdFusion must set a maximum session time-out value.
Discussion
An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwart the vulnerability of open and unused user sessions, the application server must be configured to close the sessions when a configured condition or trigger event is met. Such an event is user inactivity. ColdFusion offers an inactivity parameter that allows the setting system-wide for session timeout. ColdFusion also allows a developer to override the default timeout setting and set a new timeout. To control how large a developer can set the timeout to, a maximum setting is provided.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the "Session Variables" setting under the "Maximum Timeout" section to "1" hour or less and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If the "Session Variables" setting under the "Maximum Timeout" section is set greater than "1" hour, this is a finding.
ColdFusion must control remote access to the Administrator Console.
Discussion
Application servers provide remote access capability and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by logging connection activities of remote users. By default, localhost and all IP addresses can access the Administrator Console. Depending on the authentication method (i.e. single password, separate user name and password per user, or no authentication needed), any user from any network is capable of accessing the console and making changes to the server configuration relying only on the authentication method configured for the installation. By limiting the IP addresses that can connect, the administration console can be hosted to a management network and only accessed via that network, further reducing the exposure of the Administrator Console.
Fix Text
Navigate to the "Allowed IP Addresses" page under the "Security" menu. Set the list of allowed IP addresses for accessing ColdFusion Administrator to only those IP addresses or subnets that should be capable of reaching the Administrator Console.
Check Content
Within the Administrator Console, navigate to the "Allowed IP Addresses" page under the "Security" menu. If the list of allowed IP addresses for accessing the ColdFusion Administrator is blank, is set to "*.*.*.*" or contains IP addresses/subnets that should not have access, this is a finding.
ColdFusion must control remote access to Exposed Services.
Discussion
ColdFusion exposes many existing services as web services. These services, such as cfpdf, cfmail, and cfpop, can be accessed by users and applications written in other languages and technologies than ColdFusion CFML. To invoke the services, the client must be on the allowed IP list and have a user account with the proper privileges to the exposed services. Exposing these services expands the security risk and potential for compromise of the ColdFusion application server. If a need arises for these services, then the list of allowed IP addresses must be specified and limited to only those requiring access.
Fix Text
Navigate to the "Allowed IP Addresses" page under the "Security" menu. Remove all entries from the list under the "Allowed IP Addresses for Exposed Services" section that do not require access to ColdFusion services.
Check Content
Within the Administrator Console, navigate to the "Allowed IP Addresses" page under the "Security" menu. If there are any entries in the "Allowed IP Addresses for Exposed Services" section, validate with the SA that the IP addresses and subnets specified require access. If any of the IP addresses or subnets specified do not require access, this is a finding.
ColdFusion must control user access to Exposed Services.
Discussion
ColdFusion exposes many existing services as web services. These services, such as cfpdf, cfmail and cfpop, can be accessed by users and applications written in other languages and technologies than ColdFusion CFML. To invoke the services, the client must be on the allowed IP list and have a user account with the proper privileges to the exposed services. Exposing these services expands the security risk and potential for compromise of the ColdFusion application server. If a need arises for these services, then only those user accounts requiring access to perform the user's duties must be given access.
Fix Text
Navigate to the "User Manager" page under the "Security" menu. Only assign services to those users who require access and only assign those services that are required to perform the user's duties.
Check Content
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user by using the edit function. For each user that has values for "Allowed Services", validate with the SA that the user should have remote access to each service. If there are any users with services that are not required to perform the users' duties, this is a finding.
ColdFusion must require a username and password for access by each authorized user access.
Discussion
Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Enforcing non-repudiation of actions requires that each user be identified. Without this identification, events cannot be traced to a user, and a forensic investigation cannot be conducted to determine what exactly happened and who caused the event to occur. By forcing users to authenticate, each auditable event can be tied to a user, and a sequence of events for the user can be determined. This is critical when investigating an issue or an attack.
Fix Text
Access the "Administrator" page under the "Security" menu within the Administrator Console. Select "Separate user name and password authentication" and select the "Submit Changes" button.
Check Content
Access the "Administrator" page under the "Security" menu within the Administrator Console. If the "Separate user name and password authentication" is not selected, this is a finding.
ColdFusion must require each user to authenticate with a unique account.
Discussion
Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Enforcing non-repudiation of actions requires that each user be uniquely identified. Without this identification, events cannot be traced to a particular user, and a forensic investigation cannot be conducted to determine what exactly happened and who caused the event to occur. By forcing each user to authenticate using a unique account, each auditable event can be tied to a user, and a sequence of events for the user can be determined. This is critical when investigating an issue or an attack.
Fix Text
Create user accounts within the "User Manager" page under the "Security" menu for those users that need access to the Administrator Console.
Check Content
Review the users within the "User Manager" page under the "Security" menu. If users are not defined, this is a finding.
When ColdFusion is configured in a clustered configuration, ColdFusion must be configured to write log records from the clustered system components into a system-wide log trail that can be correlated.
Discussion
Log generation and log records can be generated from various components within the application server. The list of logged events is the set of events for which logs are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating log records (e.g., logable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked). The events occurring must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet certain tolerance criteria. For instance, DoD may define that the time stamps of different logged events must not differ by any amount greater than ten seconds. It is also acceptable for the application server to utilize an external logging tool that provides this capability.
Fix Text
Implement a strategy to aggregate the log data from the ColdFusion application servers within the cluster for system-wide log trail storage and review.
Check Content
Determine if ColdFusion is part of a clustered environment by accessing the "Instance Manager" and the "Cluster Manager" settings under the "Enterprise Manager" menu within the Administrator Console. If ColdFusion is not setup in a clustered configuration, this finding is not applicable. Ask the SA if a log record aggregation tool is being used to compile the log records from the ColdFusion application servers within the cluster for storage and review. If the log records are not being aggregated, this is a finding.
ColdFusion must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which logable events are to be logged.
Discussion
ColdFusion utilizes role-based access controls in order to specify those individuals who are able to configure logable events. Allowing users other than the ISSM and appointed individuals access to turn logged events on or off allows a user to mask their actions by disabling logging. By enabling excessive logging or by enabling debugging, a user can generate logged events containing information that can be used to later attack the system or gain access to Personally Identifiable Information (PII).
Fix Text
Navigate to the "User Manager" page under the "Security" menu and assign the following roles to the ISSM and users appointed by the ISSM to change logable events. Debugging and Logging>Logging Debugging and Logging>Code Analyzer Debugging and Logging>Debugging Debugging and Logging>License Scanner Debugging and Logging>System Probes
Check Content
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only the ISSM, or users appointed by the ISSM to change logable events, may have the following roles: Debugging and Logging>Logging Debugging and Logging>Code Analyzer Debugging and Logging>Debugging Debugging and Logging>License Scanner Debugging and Logging>System Probes If any other users have any of these roles, then this is a finding.
ColdFusion must log scheduled tasks.
Discussion
Application server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct location or process within the application server where the events occurred is important during forensic analysis. To determine where an event occurred, the log data must contain data such as application components, modules, session identifiers, filenames, host names, and functionality. ColdFusion inherently logs the location of events that take place during the normal operation of the application server, but the Executive task scheduler is not logged by default. Logging the execution of a task through the scheduler helps the administrator understand how a task was executed and also aides the administrator recognize if unauthorized scheduled tasks have been created.
Fix Text
Navigate to the "Logging Settings" page under the "Debugging & Logging" menu. Check "Enable logging for scheduled tasks" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Logging Settings" page under the "Debugging & Logging" menu. If "Enable logging for scheduled tasks" is not checked, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized read access through the Administrator Console.
Discussion
Allowing any user to view log messages provides information to individuals that may be used to compromise the system. This information may provide system design, user access/IP addresses, interconnected systems, and security settings such as encryption used and version numbers. Controlling read access to this data, either through the Administrator Console or through the OS, must be controlled or limited to only those individuals who need access to fulfill their responsibilities.
Fix Text
Enable the Debugging and Logging>Logging role for those users that require the ability to read log files. This parameter is set in the "User Manager" page under the "Security" menu.
Check Content
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only users given the responsibility to read logs should have the following role assigned: Debugging and Logging>Logging If any user, other than those assigned to read logs, is assigned this role, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized read access by having file permissions set properly.
Discussion
Allowing any user to view log messages provides information to individuals that may be used to compromise the system. This information may provide system design, user access/IP addresses, interconnected systems, and security settings such as encryption used and version numbers. Controlling read access to this data, either through the Administrator Console or through the OS, must be controlled or limited to only those individuals who need access to fulfill their responsibilities.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object". 9. Click "OK" to apply these permissions. ColdFusion running on Linux Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized modification by having file permissions set properly.
Discussion
Allowing any user to modify log messages provides a method for an attacker to hide his attack and go unnoticed. Log modification also makes forensic investigation difficult, if not impossible, as the information needed to recreate the event is either deleted or modified to hide what actions took place. Users are unable to modify log data through the Administrator Console, so the protection from modification is only relevant by enforcing protections from modification at the OS level. This is performed by properly setting file permissions and enforcing user logons that match each user's job role.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized deletion through the Administrator Console.
Discussion
When a system is attacked, one of the tasks of the attacker is to cover his tracks by deleting log files or log data. This enables the attacker to go unnoticed and to make later forensic analysis of the attack difficult, if not impossible. To protect the log information from deletion and discover the attacker quickly, the log files must be protected. This protection must take place at both the Administrator Console and at the OS level. Within the Administrator Console, the protection can be performed by giving users the proper roles and only giving log deletion to those that need that capability to perform their job duties. At the OS level, protecting the logs from deletion is performed by assigned the proper privileges to the log files and also giving OS users limited roles.
Fix Text
Enable the Debugging and Logging>Logging role for those users that require the ability to delete log files. This parameter is set in the "User Manager" page under the "Security" menu.
Check Content
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only users given the responsibility to delete logs should have the Debugging and Logging>Logging role assigned. If any user, other than those assigned the capability to delete logs, is assigned this role, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized deletion by having file permissions set properly.
Discussion
When a system is attacked, one of the tasks of the attacker is to cover his tracks by deleting log files or log data. This enables the attacker to go unnoticed and to make later forensic analysis of the attack difficult, if not impossible. To protect the log information from deletion and discover the attacker quickly, the log files must be protected. This protection must take place at both the Administrator Console and at the OS level. Within the Administrator Console, the protection can be performed by giving users the proper roles and only giving log deletion to those that need that capability to perform their job duties. At the OS level, protecting the logs from deletion is performed by assigned the proper privileges to the log files and also giving OS users limited roles.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
ColdFusion must send log records to the operating system logging facility.
Discussion
Protection of log data includes assuring log data is not accidentally lost or deleted. By sending some of the log messages to the operating system logging facilities, these log messages become part of the OS log history, become part of the log review performed by the OS administrator, and become part of the backup of OS log data. Note: This feature is only available for Linux installations.
Fix Text
Navigate to the "Logging Settings" page under the "Debugging & Logging" menu. Check "Use operating system logging facilities" and select the "Submit Changes" button.
Check Content
This feature is not present when ColdFusion is installed on Windows; therefore, this finding is not applicable. Within the Administrator Console, navigate to the "Logging Settings" page under the "Debugging & Logging" menu. If "Use operating system logging facilities" is not checked, this is a finding.
ColdFusion must allocate log record storage capacity in accordance with organization-defined log record storage requirements.
Discussion
The proper management of log records not only dictates proper archiving processes and procedures be established, it also requires allocating enough storage space to maintain the logs online for a defined period of time. If adequate online log storage capacity is not maintained, intrusion monitoring, security investigations, and forensic analysis can be negatively affected. It is important to keep a defined amount of logs online and readily available for investigative purposes. The logs may be stored on the application server until they can be archived to a log system or, in some instances, a Storage Area Network (SAN). Regardless of the method used, log record storage capacity must be sufficient to store log data when the data cannot be off-loaded to a log system or a SAN. ColdFusion handles logs by allowing the administrator to specify a log file size and how many archives to keep online. This allows the administrator to correctly size the storage needed to meet the requirements of the organization for how log audit files should be available online and configure the storage needed to meet the requirement before off-loading archives to off-line storage.
Fix Text
Move the location of the log files to a directory that has sufficient storage to meet the organization-defined log record storage requirement.
Check Content
Locate the log file directory by viewing the "Log directory" setting within the "Logging Settings" page under the "Debugging & Logging" menu. Also make note of the "Maximum number of archives" and "Maximum file size (in kilobytes)" settings. Next, view the number of log files generated. This can be found by accessing the "Log Files" page under the "Debugging & Logging" menu. Count the number of log files. If "Maximum number of archives" multiplied by "Maximum file size (in kilobytes)" multiplied by the number of log files is larger than the storage where the log directory is located, this is a finding.
ColdFusion log records must be off-loaded onto a different system or media from the system being logged.
Discussion
Information system logging capability is critical for accurate forensic analysis. Off-loading is a common process in information systems with limited log storage capacity. Centralized management of log records provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Application servers and their related components are required to off-load log records on to a different system or media than the system being logged. ColdFusion offers the capability to set the number of archived log files to keep before overwriting the file along with the maximum file size before generating an archive. This allows the administrator to set up a scheduled task or a centralized log management system to pull the log files.
Fix Text
Configure a scheduled task or log management application to store the log files to another system or media.
Check Content
Locate the log file directory by viewing the "Log directory" setting within the "Logging Settings" page under the "Debugging & Logging" menu. Have the administrator show the scheduled task or log management application that accesses this directory and stores the log files to another system or media. If the administrator cannot demonstrate that the log files are being stored to another system or media, this is a finding.
ColdFusion logs must, at a minimum, be transferred simultaneously for interconnected systems and transferred weekly for standalone systems.
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. ColdFusion does not offer an automated mechanism to off-load logs, but ColdFusion does have the capability to create archive log files. By using the archive capability, off-loading can be set up using a weekly scheduled task for standalone systems. For interconnected systems, applications such as syslog on Linux can be used to off-load data simultaneously.
Fix Text
Implement a strategy that transfers logs weekly for standalone systems and simultaneously for interconnected systems.
Check Content
Interview the administrator to determine whether or not ColdFusion logs are transferred to another system weekly for standalone systems and simultaneously for interconnected systems. If the logs are not transferred weekly for standalone systems and simultaneously for interconnected systems, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.
Discussion
Allowing any user to view log messages provides information to individuals that may be used to compromise the system. This information may provide system design, user access/IP addresses, interconnected systems, and security settings such as encryption used and version numbers. Controlling read access to this data, either through the Administrator Console or through the OS, must be controlled or limited to only those individuals who need access to fulfill their responsibilities.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized modification by having file ownership set properly.
Discussion
Allowing any user to modify log messages provides a method for an attacker to hide his attack and go unnoticed. Log modification also makes forensic investigation difficult, if not impossible, as the information needed to recreate the event is either deleted or modified to hide what actions took place. Users are unable to modify log data through the Administrator Console, so the protection from modification is only relevant by enforcing protections from modification at the OS level. This is performed by properly setting file permissions and enforcing user logons that match each user's job role.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
The ColdFusion log information must be protected from any type of unauthorized deletion by having file ownership set properly.
Discussion
When a system is attacked, one of the tasks of the attacker is to cover his tracks by deleting log files or log data. This enables the attacker to go unnoticed and to make later forensic analysis of the attack difficult, if not impossible. To protect the log information from deletion and discover the attacker quickly, the log files must be protected. This protection must take place at both the Administrator Console and at the OS level. Within the Administrator Console, the protection can be performed by giving users the proper roles and only giving log deletion to those that need that capability to perform their job duties. At the OS level, protecting the logs from deletion is performed by assigned the proper privileges to the log files and also giving OS users limited roles.
Fix Text
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
Check Content
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
ColdFusion must limit applications from changing shared Java components.
Discussion
Application servers have the ability to specify that the hosted applications utilize shared libraries. Within ColdFusion, these shared libraries are often Java components along with server settings. By allowing programmers or attackers to write CFML code that can directly access these components and settings, the programmer can change how shared Java components work and create new Java components. By disabling this option, the programmer is unable to read or modify administration and configuration information for the server and shared Java components.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable access to internal ColdFusion Java components" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Disable access to internal ColdFusion Java components" is unchecked, this is a finding.
ColdFusion must limit privileges, within the Administrator Console, to change the software resident within software libraries.
Discussion
Controlling the overall security posture of the server encompasses controlling the patches and versions of the software running within the production environment. Patches are installed to fix security and bug issues. Vendors will often supply a feature to uninstall the patch in the event the patch does not install correctly, if the patch causes issues with hosted applications, or if the patch contains issues not found during testing. The uninstall feature is meant to be used by an SA to maintain a secure and stable system. In the event an attacker gains access to the uninstall functionality, he can then attempt to revert the system to an unsecure version which may have known and documented attacks that can be successful to compromise ColdFusion. To protect against this type of attack and to further define roles for users, access to the patch management functionality is important. Proper protection is performed through assigning the appropriate roles to the users of the Administrator Console and through the least privileged permissions assigned at the OS level.
Fix Text
Navigate to the "User Manager" page under the "Security" menu. Remove the "Server Updates" role from each user that should not have access to patch management functions.
Check Content
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user and ask the SA if the user should have access to server patch management functions. For each user that should not be able to access patch management functions, review the roles assigned to the user account. If the user has the "Server Updates" role, this is a finding.
ColdFusion must protect software libraries from being changed by OS users.
Discussion
Controlling the overall security posture of the server encompasses controlling the patches and versions of the software running within the production environment. Patches are installed to fix security and bug issues. Vendors will often supply a feature to uninstall the patch in the event the patch does not install correctly, if the patch causes issues with hosted applications, or if the patch contains issues not found during testing. The uninstall feature is meant to be used by an SA to maintain a secure and stable system. In the event an attacker gains access to the uninstall functionality, he can then attempt to revert the system to an unsecure version which may have known and documented attacks that can be successful to compromise ColdFusion. To protect against this type of attack and to further define roles for users, access to the patch management functionality is important. Proper protection is performed through assigning the appropriate roles to the users of the Administrator Console and through the least privileged permissions assigned at the OS level.
Fix Text
Locate the hf-updates directory for ColdFusion. The hf-updates directory should have the following permissions: ColdFusion running on Windows: 1. Right click on the "hf-updates" directory and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly and chown to set the owner and group. For example, if the hf-updates directory is found at /opt/cf11/cfusion/hf-updates and you want to set the owner to cfuser, the commands would be: chown cfuser:root /opt/cf11/cfusion/hf-updates chmod 750 /opt/cf11/cfusion/hf-updates
Check Content
Locate the hf-updates directory for ColdFusion. Review the permissions on the hf-updates directory. ColdFusion running on Windows should have full control for the Administrators group and the user running the ColdFusion application. No other users or groups should have permissions. If permissions are granted to other users or groups, this is a finding. If ColdFusion is installed on Linux, the permissions must be "750" or more restrictive with the owner set to the user running the ColdFusion service and a group of root. If the permissions are more permissive, this is a finding.
ColdFusion must only allow approved file extensions.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. One area of concern is the file types that can be included in cfm and cfml files by programmers. To control what types of technologies are used in the development of hosted applications, a default whitelist can be created and approved by the ISSO. This list includes only those file extensions that are used by the hosted applications. By default, cfm and cfml are included and do not have to be specified. The list must not contain the wildcard string "*.*".
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Enter the list of approved file extensions in the "Allowed file extensions for CFInclude tag" field and select the "Submit Changes" button. A blank list will only allow cfm and cfml files to be included and fulfills this requirement.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allowed file extensions for CFInclude tag" is empty, this is not a finding. If the "Allowed file extensions for CFInclude tag" contains the wildcard string "*.*" or if the list of file extensions is not the list approved by the ISSO, this is a finding.
ColdFusion must disable Flash Remoting support.
Discussion
Application servers provide a myriad of differing processes, features and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Flash Remoting allows a Flash client to connect to the ColdFusion server and invoke ColdFusion Components (CFCs). Allowing this service to be enabled when not needed by hosted applications and when ColdFusion server monitoring is not being used provides an avenue for an attacker to gain access to the server.
Fix Text
Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck the "Enable Flash Remoting" option and select the "Submit Changes" button.
Check Content
Ask the administrator if ColdFusion server monitoring is being used or if flex remoting is being used by any hosted applications. If ColdFusion server monitoring is being used or hosted applications are using flash remoting, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If the "Enable Flash Remoting" option is checked, this is a finding.
ColdFusion must disable the In-Memory File System.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. ColdFusion offers an in-memory file system. This feature can be used to have dynamic code execute quickly which in turns enables an application to execute quicker. This feature can also be used by an attacker to execute dynamic code that is erased and unrecoverable on system reboot making forensic analysis impossible.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Enable In-Memory File System" and select the "Submit Changes" button.
Check Content
Ask the administrator if the in-memory file system is being used by any hosted applications. If hosted applications are using the in-memory file system, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Enable In-Memory File System" is checked, this is a finding.
ColdFusion must have Event Gateway Services disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Event Gateway Services are used to pass events from external sources to ColdFusion components that are specified. Since this gateway is accepting events from external sources, a listener must be present. When enabled, along with the listener, memory, queues, and processes are available for gateway processes. These resources can be used by an attacker and should be disabled if the feature is not being used for hosted applications.
Fix Text
Navigate to the "Settings" page under the "Event Gateway" menu. Uncheck "Enable ColdFusion Event Gateway Services" and select the "Submit Changes" button.
Check Content
Ask the administrator if Event Gateway services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Event Gateways" menu. If "Enable ColdFusion Event Gateway Services" is checked, this is a finding.
ColdFusion must have Remote Development Services (RDS) disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Development Services (RDS) is used in a development environment to allow authenticated users access to the server using special features within code editors like Dreamweaver, HomeSite+, ColdFusion Studio, and Eclipse to obtain information from the server. For example, developers can determine what data sources exist, query them, build code based on them, and more. RDS also enables access from within the editors to files on the server (even remotely) over HTTP, as an alternative to FTP. This feature is not meant for production environments.
Fix Text
Navigate to the "RDS" page under the "Security" menu. Uncheck "Enable RDS Service" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "RDS" page under the "Security" menu. If "Enable RDS Service" is checked, this is a finding.
ColdFusion must have Remote Adobe LiveCycle Data Management access disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Adobe LiveCycle Data Management access allows LiveCycle Data Services ES to connect to the ColdFusion server through RMI and use CFCs to read and update data that supports a Flex application. If this feature is not needed for hosted applications and is enabled, an attacker could use this feature to compromise the ColdFusion server.
Fix Text
Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck "Enable Remote Adobe Live Cycle Data Management access" and select the "Submit Changes" button.
Check Content
Ask the administrator if LiveCycle Data Services ES are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable Remote Adobe LiveCycle Data Management access" is checked, this is a finding.
ColdFusion must have the WebSocket Service disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. The WebSocket Service is used to develop real-time applications for stock, charting, online gaming, social networking, dashboard for various purposes, and monitoring. The service uses http or https for communication either to a proxy server or to the built-in WebSocket Server. When the service is enabled and not used, resources are used but set idle. To allow the idle resources to be used for other services, if the WebSocket service is not be used by hosted applications, the service must be disabled.
Fix Text
Navigate to the "WebSocket" page under the "Server Settings" menu. Uncheck "Enable WebSocket Service" and select the "Submit Changes" button.
Check Content
Ask the administrator if WebSocket services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "WebSocket" page under the "Server Settings" menu. If "Enable WebSocket Service" is checked, this is a finding.
ColdFusion must have example data sources removed.
Discussion
ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.
Fix Text
Remove the sample data sources by navigating to the "Data Sources" page under the "Data & Services" menu. Delete the data sources cfartgallery, cfbookclub, cfcodeexplorer, and cfdocexamples.
Check Content
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Data Sources" page under the "Data & Services" menu. If the data sources cfartgallery, cfbookclub, cfcodeexplorer, or cfdocexamples exist, this is a finding.
The ColdFusion built-in TomCat Web Server must be disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. The built-in TomCat Web Server is used to host the Administrator Console and is used for initial setup. While the built-in server can be used to continually host the Administrator Console, this is not the best practice since the server is not guaranteed to be patched and upgraded, implementing TLS is not well documented, allowing for poor implementations, and commercial web servers offer better logging. To enable the Administrator Console to still operate and disable the built-in TomCat Web Server, the Administrator Console application must be moved to the web server (i.e., IIS, Apache, IBM HTTP Server, etc.) hosting the ColdFusion applications. Moving the Administrator Console to Apache and IIS is well documented in the Adobe ColdFusion Lockdown Guide.
Fix Text
Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. After making a backup of this file, edit the file and locate the following xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is setup at install and can be changed, so this parameter may be different in this line. This line can be deleted or using XML syntax can be commented out of the configuration. XML comment syntax starts with <!-- and ends with -->, e.g., <!-- XML COMMENT -->.
Check Content
Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. Within the server.xml file, locate the xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is defined during the install and can be changed from the default of 8500, so this parameter may be different if an alternate port was assigned. If the line exists and is not commented out (XML comments start with <!-- and end with -->, e.g., <!-- XML COMMENT -->), this is a finding.
ColdFusion must have Remote Inspection disabled.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Inspection is used to debug mobile applications and may contain sensitive information. This feature may be necessary as applications are built and tested, but once in a production environment, this setting is not necessary for daily operations and must be disabled.
Fix Text
Navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. Uncheck "Allow Remote Inspection" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. If "Allow Remote Inspection" is checked, this is a finding.
ColdFusion must protect internal cookies from being updated by hosted applications.
Discussion
Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Allowing developers to override global session cookie security settings is used to allow a hosted application to change the security posture of the application server. This feature may be necessary as applications are built and tested, but once in a production environment, this functionality is not necessary for daily operations and must be disabled.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." is unchecked, this is a finding.
ColdFusion must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
Discussion
Some networking protocols may not meet organizational security requirements to protect data and components. ColdFusion may host a number of various features, such as the Administrator Console, data sources and various services. These features all run on TCPIP ports and protocols. This creates the potential that the vendor or ColdFusion administrator may choose to utilize port numbers or protocols that have been deemed unusable by the organization. When ports or protocols are used that are not secure or authorized by the organization, the ColdFusion feature must be reconfigured to use an authorized port and protocol. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.
Fix Text
Reconfigure the services or data connections that are using an unapproved port to use an approved port.
Check Content
Access the Administrator Console from a web browser. If a port is part of the URL, verify that the port used is an approved port. Within the Administrator Console, navigate to each page under the "Data & Services" menu viewing the port settings for each connection and service. If the Administrator Console or any "Data & Services" setting is not using an approved port, this is a finding.
ColdFusion must disable auto reloading of configuration files on file changes.
Discussion
When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software and/or application server configuration can potentially have significant effects on the overall security of the system. Allowing ColdFusion to watch for configuration file changes and reloading the new configuration gives an attacker an easy way to make modifications and have those changes become part of the executing production system quickly.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Check configuration files for changes every" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Check configuration files for changes every" is checked, this is a finding.
The ColdFusion Root Administrator account must have a unique username.
Discussion
The ColdFusion Root Administrator account is an administrative account setup during the installation process. This account has privileges to view, update and delete data within the entire ColdFusion Administrator Console. The account is meant to be used to setup ColdFusion after installation, but should only be used in emergency situations once user accounts are created. The account is similar to the Administrator account in Windows or the root account in Linux. To help protect the account, the account username should not be admin or administrator. If setup with these usernames, an attacker already knows 50% of the information needed to gain access. A unique and not easily guessable username must be used to hinder the discovery of the account credentials.
Fix Text
Locate the neo-security.xml file and change to the directory where the file is located. Note: Make a backup of the file before making any modifications. For ColdFusion running on Windows: 1. Open the file neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 5. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 6. Save the file. 7. Restart ColdFusion to have the new username take effect. Within a terminal window, change to the bin directory under the ColdFusion installation directory and execute the command: coldfusion -restart -console ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Update the Root Administrator username by editing the neo-security.xml file. 3. Locate the <var name='admin.userid.root'> tag. The username is located in between the <string> and </string> tags that follow. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 4. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 5. Save the file. 6. Restart ColdFusion to have the new username take effect. ColdFusion can be restarted by changing to the bin directory under the ColdFusion installation directory and execute the command: coldfusion restart Validate that the new username is being used and that the system is operating properly. Once validated, the backup neo-security.xml file must be deleted.
Check Content
Locate the neo-security.xml file and locate the Root Administrator username. For ColdFusion running on Windows: 1. Open the neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> For ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Execute the following command to return the Root Administrator username: cat neo-security.xml | grep –i –oP ‘admin.userid.root’+”’><string>\K\w+” If the Root Administrator username is any upper-and lower-case mix of characters for the words admin or administrator (e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc.), this is a finding.
ColdFusion must execute as a non-privileged user.
Discussion
Privileged user accounts are accounts that have access to all the system resources. These accounts are reserved for administrative users and applications that have a need for such unfettered access. Because ColdFusion does not need to run with access to all the system resources, the ColdFusion services must be setup to execute as unprivileged users. This protects server resources, OS hosted applications, and organization resources should the ColdFusion application server become compromised.
Fix Text
For ColdFusion running on Windows: 1. Create a user for the ColdFusion services by running the snap-in compmgmt.msc. 2. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 3. Select the "Users" folder. 4. Right click in the right pane and select "New User". 5. Enter a username and password for the user. Follow any organization specific policies in place and Windows STIGs for password complexity, usernames, etc. 6. Select the "Create" button to create the user. 7. Right click on the new user and select the "Properties" menu item. 8. Select the "Member Of" tab. 9. Remove all groups. 10. Select the "Remote Desktop Services Profile" tab. 11. Check the "Deny this user permissions to log on to Remote Desktop Session Host server" checkbox. 12. Select the "Apply" button. 13. Run the snap-in services.msc. 14. Locate the ColdFusion services. 15. Right click on a ColdFusion service and select "Properties". 16. Select the "Log On" tab. 17. Click on the "This account:" radio button. 18. Enter the username and password for the user account that was just created. 19. Select "Ok" to save the changes. 20. Repeat steps 15 through 19 for each ColdFusion service. ColdFusion running on Linux: 1. Create a group for the user account that will run the ColdFusion service by executing the command groupadd. For example, if the group being created is webusers, the command would be: groupadd webusers 2. Create the user account for the service by executing the command adduser. For example, if the user being created is cfuser with the group webusers, the command would be: adduser -g webusers -s /sbin/nologin -M -c ColdFusion cfuser 3. Assign a password to the account that follows any organization password policies in place and the OS STIG for password complexity. The password is assigned by executing the command: passwd cfuser 4. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 5. Change to the directory where the file is located. 6. Edit the coldfusion_11 file. 7. Locate the text RUNTIME_USER= within coldfusion_11 8. Update the user account being used to run the ColdFusion service.
Check Content
For ColdFusion running on Windows: 1. Run the snap-in services.msc. 2. Locate the ColdFusion section of services. 3. Right click on each ColdFusion service and select "Properties". 4. Select the "Log On" tab. If any service has "Local System account" selected, this is a finding. 5. View the groups for each user account that was used to run a ColdFusion service by running the snap-in compmgmt.msc. 6. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 7. Select the "Users" folder and the users will be listed in the right pane. 8. Right click a user that runs a ColdFusion service. 9. Select "Properties" on the menu. 10. Select the "Member Of" tab. If any groups are listed, this is a finding. 11. Click on the "Remote Desktop Services Profile" tab. If the "Deny this user permissions to log on to Remote Desktop Session Host server" is not checked, this is a finding. 12 Repeat steps 8 through 11 for each user that runs a ColdFusion service. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Execute the command: grep -i -m 1 runtime_user coldfusion_11 4. The user being used to execute ColdFusion will be listed. 5. View the user within the /etc/passwd file. 6. Make note of the user id and group id. For example, if the line in the passwd file is cfuser:x:500:501:ColdFusion:/home/cfuser:/sbin/nologin, the user id is 500 and the group id is 501. If the user id or the group id is set to 0 (zero), this is a finding.
ColdFusion accounts with access to the Administrator Console must be approved.
Discussion
ColdFusion offers an Administrator Console that is used to setup ColdFusion. The console allows the administrator to setup user accounts, user privileges, logging, data sources, etc. These accounts, once setup, do not automatically lock after a set duration of inactivity or any other security event that would require automatic locking or deletion. This would enable an account for a user who either left the organization or changed job roles, to continue access the console until the account is manually deleted. To make certain that the user accounts are only those that are needed, the accounts must be approved by the ISSM.
Fix Text
Navigate to the "User Manager" page under the "Security" menu. Modify the list of users to only contain those approved by the ISSM.
Check Content
Review the users within the "User Manager" page under the "Security" menu. If users exist that are not approved by the ISSM, this is a finding.
ColdFusion must protect newly created objects.
Discussion
During operation, ColdFusion may create objects such as files to store parameters or log data, or pipes to share data between objects. When the objects are created, it is important that the newly created object has the correct permissions. This can be performed by assigning the proper umask value to the running process. For the ColdFusion service, the umask must be set to 007 or more restrictive.
Fix Text
For ColdFusion running on Windows, this finding is not applicable. 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Add the umask setting near the top of the file, but below the #description comment. A sample umask setting looks like: umask 007
Check Content
For ColdFusion running on Windows, this finding is not applicable. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Locate the umask setting. It should be located near the top of the file, but below the #description comment. If the umask is not set to 007 or more restrictive, this is a finding.
ColdFusion must have Sandbox Security enabled.
Discussion
Application isolation allows multiple applications to run on the same hosting operating system, web server and application server. Typical reasons to isolate applications are to separate different application user bases, data security levels, protect application resources, and to give least privileges to each application to system resources. Application isolation will also contain an application that has been compromised from compromising other hosted applications. To allow sandboxing to be implemented, the feature must be enabled.
Fix Text
Navigate to the "Sandbox Security" page under the "Security" menu. Check "Enable ColdFusion Sandbox Security" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If "Enable ColdFusion Sandbox Security" is unchecked, this is a finding.
ColdFusion must have Sandboxes defined for application execution.
Discussion
Application isolation allows multiple applications to run on the same hosting operating system, web server and application server. Typical reasons to isolate applications are to separate different application user bases, data security levels, protect application resources, and to give least privileges to each application to system resources. Application isolation will also contain an application that has been compromised from compromising other hosted applications. To implement sandboxing, sandboxes must be setup to separate applications. Enabling the feature without implementing sandboxes does not secure the system.
Fix Text
Navigate to the "Sandbox Security" page under the "Security" menu. Create sandboxes for the applications to operate within and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. Sandboxes should be setup for the Administrator Console and any other hosted applications. The Administrator Console must have its own sandbox separate from the other hosted applications. If there are no sandboxes implemented for the Administrator Console and the other hosted applications, this is a finding.
ColdFusion must have the Default ScriptSrc Directory set to a non-default value.
Discussion
The scripts directory contains common javascript code that may be used by the hosted applications. This code is offered to help the developer with common data controls and functions aiding in the quick development of applications. Unfortunately, this code has also been known to have security vulnerabilities. Because of this, many of the ColdFusion hacking tools look for this directory in the default location searching for files with known vulnerabilities. By moving the directory to a non-default location, the hacking tools are unable to find the directory making it more difficult for the attacker.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Enter the new location for the ScriptSrc Directory.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Default ScriptSrc Directory" is set to /CFIDE/scripts/", this is a finding.
ColdFusion must contain the most recent update.
Discussion
ColdFusion releases updates to ColdFusion 11 to add support, fix bugs and close security issues. Without the current update installed, the product may be unstable or become a target for an attacker who can take advantage of a known exploit. The updates, when available, must be tested and installed as soon as possible.
Fix Text
Navigate to the "Update" page under the "Server Update" menu. Enter the "Available Updates" tab and install the latest patch available. If the ColdFusion server is patched from the command line and not through the ColdFusion Console, the latest patch must be downloaded manually, the hash value verified and then installed using the instructions provided with the patch.
Check Content
Within the Administrator Console, navigate to the "Updates" page under the "Server Update" menu. If the "Available Updates" tab is showing that updates are available, this is a finding. A list of updates available can be retrieved from the update site. Enter the "Settings" tab and copy the URL listed in the "Site URL" field. Paste the URL into a browser and make note of the newest update available. If the "Site URL" field is empty or if a local update server is being used and the site does not list the updates, the ColdFusion update site can be reached at https://helpx.adobe.com/coldfusion/kb/coldfusion-11-updates.html Enter the "Installed Updates" tab and verify that the update installed is the latest listed on the update site. If the latest update is not installed, this is a finding.
ColdFusion must have example collections removed.
Discussion
ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.
Fix Text
Remove the sample collections by navigating to the "ColdFusion Collections" page under the "Data & Services" menu. Delete the bookclub collection.
Check Content
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "ColdFusion Collections" page under the "Data & Services" menu. If the bookclub collection exists, this is a finding.
ColdFusion must have example gateway instances removed.
Discussion
ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.
Fix Text
Remove the sample gateway instances by navigating to the "Gateway Instances" page under the "Event Gateways" menu. Delete the Gateway Instance SMS Menu App.
Check Content
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Gateway Instances" page under the "Event Gateways" menu. If the Gateway Instance SMS Menu App. exists, this is a finding.
ColdFusion must authenticate users individually.
Discussion
To assure individual accountability and prevent unauthorized access, application server users must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. ColdFusion is installed with a Root Administrator Account. This account is configured during the installation phase. This account should only be used for initial setup before user accounts are created and should not be used for day-to-day operations. When used as a group account, accountability, along with least privileges for the users, is lost.
Fix Text
Navigate to the "User Manager" page under the "Security" menu. Create users that need access to the Administrator Console providing only the roles necessary to perform each job function.
Check Content
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. If there are no defined users, this is a finding.
ColdFusion must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.
Discussion
Application servers may provide a web services capability that could be leveraged to allow remote access to sensitive application data. Many web services utilize SOAP, which in turn utilizes XML and HTTP as a transport. Natively, SOAP does not provide security protections. As such, the application server must provide security extensions to enhance SOAP capabilities to ensure that secure authentication mechanisms are employed to protect sensitive data. The ws-security suite is a widely used and acceptable SOAP security extension. ColdFusion offers SOAP capabilities but does not offer any type of security for these services. In order to extend the security of the SOAP protocol, an administrator must install the ws-security suite to enhance SOAP through Java Web Services and configure the ws-security features within the new object. This new object then becomes the wrapper for the SOAP communication, securing the sensitive data.
Fix Text
If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Install the ws-security suite to secure access to sensitive data.
Check Content
Determine if web services are published using the SOAP protocol to access sensitive data. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Determine if the ws-security suite is in place to provide secure authentication to the sensitive data by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are published using the SOAP protocol to access sensitive data and the ws-security suite is not used to secure the access, this is a finding.
ColdFusion must transmit only encrypted representations of passwords for Flex Integration.
Discussion
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion offers RMI communication between Flex and ColdFusion. The communication between the two will require authentication data. When authentication data is transmitted, the data must be encrypted to protect it from discovery. This can be done by enabling RMI over SSL within the Administrator Console.
Fix Text
Navigate to the "Flex Integration" page under the "Data & Services" menu. Check "Enable RMI over SSL for Data Management" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. Ask the administrator if Flex is being used and if user credentials are being used for authentication. If user credentials are being used for Flex authentication to ColdFusion and "Enable RMI over SSL for Data Management" is not checked, this is a finding.
The ColdFusion Administrator Console must transmit only encrypted representations of passwords.
Discussion
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion uses username and password for users to authenticate to the Administrator Console. When these credentials are sent in plaintext, an attacker can capture the information and use the credentials to log on to the console, creating objects, connections, and accounts for later use. The attacker will also have access to information stored for connections to other systems that ColdFusion may be connected to for data retrieval.
Fix Text
Review the documentation for the web server where the Administrator Console is being hosted and setup https encryption to protect passwords during the authentication process.
Check Content
Access the Administrator Console through a web browser. Look for indications that the communication is an https session through the prefix of https on the url and/or the lock icon, depending on the browser in use. If https does not appear to be in use, this is a finding.
ColdFusion must transmit only encrypted representations of passwords to the mail server.
Discussion
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion may use username/password to connect to a mail server. When this authentication method is used, it is important that the credentials be protected when transmitted by being encrypted. While TLS encryption is the preferred method by DoD, SSL can be used when the mail server does not offer any other method of encryption.
Fix Text
Navigate to the "Mail" page under the "Server Settings" menu. Enable SSL/TLS by checking "Enable SSL socket connections to mail server" and/or "Enable TLS connection to mail server" options and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Mail" page under the "Server Settings" menu. If a user name and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.
Only authenticated system administrators or the designated PKI Sponsor for ColdFusion must have access to ColdFusions private key.
Discussion
The cornerstone of PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and can pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the private keys. Java-based application servers, such as ColdFusion, utilize the Java keystore, which provides storage for cryptographic keys and certificates. ColdFusion uses the keystore to store private keys for ColdFusion WebSockets and for Flex Integration.
Fix Text
Locate the keystore file(s). The location can be found in the Administrator Console within the "Flex Integration" page under the "Data & Services" menu and within the "WebSocket" page under the "Server Settings" menu. The keystore(s) should have the following permissions: ColdFusion running on Windows: 1. Right click on the keystore and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click 'Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly and chown to set the owner and group. For example, if the keystore is named /opt/cf11/jre/lib/security/cacerts and you want to set the owner to cfuser, the commands would be: chown cfuser:root /opt/cf11/jre/lib/security/cacerts chmod 750 /opt/cf11/jre/lib/security/cacerts
Check Content
Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable RMI over SSL for Data Management" is checked, make note of the path and filename of the keystore used. Navigate to the "WebSocket" page under the "Server Settings" menu. If "SSL Port" is checked, make note of the keystore path and filename. Review the permissions on the files designated in the keystore locations specified. ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion on the keystore file. No other users should have permissions. If permissions are granted to other users or roles, this is a finding. If ColdFusion is installed on Linux, the permissions must be 750 or more restrictive with the owner set to the user running the ColdFusion service and a group of root. If the permissions are more permissive, this is a finding.
The ColdFusion Administrator Console must be hosted on a management network.
Discussion
ColdFusion consists of the Administrator Console and hosted applications. By separating the Administrator Console from hosted applications, the user must authenticate as a privileged user to the Administrator Console before being presented with management functionality. This prevents non-privileged users from having visibility to functions not available to the user. By limiting visibility, a compromised non-privileged account does not offer information to the attacker to functionality and information needed to further the attack on the application server. By hosting the Administrator Console on a management-only network, the console is protected from hosted application users, is isolated to only management devices, is not vulnerable to accidental discovery, and most management networks encrypt all traffic protecting management data from accidental disclosure.
Fix Text
Host the ColdFusion Administrator Console on a management network.
Check Content
Access the Administrator Console through a browser making note of the IP address that is used to access the console. Review the site's network diagram to validate that the IP used is on a management network and is separate from the public network. If the Administrator Console is not part of a management network, this is a finding.
The ColdFusion Administrator Console must be hosted in a management sandbox.
Discussion
ColdFusion consists of the Administrator Console and hosted applications. By separating the Administrator Console from hosted applications, the user must authenticate as a privileged user to the Administrator Console before being presented with management functionality. This prevents non-privileged users from having visibility to functions not available to the user. By limiting visibility, a compromised non-privileged account does not offer information to the attacker to functionality and information needed to further the attack on the application server. By hosting the Administrator Console within its own sandbox from other hosted applications, the administrative objects are protected from reuse and modification by the other hosted applications.
Fix Text
Navigate to the "Sandbox Security" page under the "Security" menu. Create sandbox for the Administrator Console to operate within and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If the Administrator Console is not hosted within a sandbox, this is a finding.
ColdFusion must disable creation of unnamed applications.
Discussion
ColdFusion allows applications to be named or unnamed. The application name allows the developer to scope the application or define a logical application and allows for the separation of applications. When an application is unnamed, the application scope corresponds to the ColdFusion JEE servlet context. This also means that the application session corresponds directly to the session object of the JEE application server. Having unnamed applications is only necessary when the ColdFusion pages must share application or session scope data with existing JSP pages and servlets. Disabling the ability for unnamed applications allows the Administrator Console and all the other hosted applications to be isolated from each other.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable creation of unnamed applications" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Disable creation of unnamed applications" is unchecked, this is a finding.
ColdFusion must not allow application variables to be added to Servlet Context.
Discussion
ColdFusion allows applications to add application variables to the Servlet Context. This allows an application to add data or change configuration data for all hosted applications. By sharing data across applications, the applications are no longer isolated with one application affecting other applications. By disabling this capability, the hosted applications, including the Administrator Console, are isolated.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Allow adding application variables to Servlet Context" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allow adding application variables to Servlet Context" is checked, this is a finding.
ColdFusion must enable UUID for session identifier generation.
Discussion
Unique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of session identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. ColdFusion offers session ID randomness and uniqueness by enabling UUID for the session ID. Without this option enabled, session values are sequential and become easy to hijack through guessing.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Use UUID for cftoken" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Use UUID for cftoken" is not checked, this is a finding.
ColdFusion must use J2EE session variables.
Discussion
Unique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of session identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. By enabling J2EE session management, each session is given a unique and non-sequential session id which is shared between the JVM and the ColdFusion application allowing for easier session management. J2EE session management stores the session data within a cookie stored in memory which will only exist while the session is valid. When J2EE sessions management is not used, the cookie is stored on the hard drive allowing for a cookie that can be easily harvested by an attacker.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Use J2EE session variables" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Use J2EE session variables" is not checked, this is a finding.
ColdFusion must set session cookies as browser session cookies.
Discussion
Generating a unique session identifier for each session inhibits an attacker from using an already authenticated session identifier that has not been invalidated. If an attacker is able to use an authenticated session, the attacker is given the privileges of the user who created the session. This may allow the attacker to generate user accounts for later use, change configuration settings, deploy an application or change application modules and code for already hosted applications, or see usernames for trusted relationships to other resources. It is important that each new session is given a new and unique session identifier and that old identifiers are discarded quickly. ColdFusion offers the capability to set session Cookies and all other Cookies to browser cookies. This means all cookies become invalid once the browser window is closed instead of setting a time to live to the cookie. Setting the cookies to browser cookies will ensure the session identifier is invalidated once the user ends the session through closing the browser.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the parameter "Cookie Timeout" to -1 and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Cookie Timeout" is not set to -1, this is a finding.
ColdFusion must provide a clustering capability.
Discussion
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. When application failure is encountered, preserving application state facilitates application restart and return to the operational mode of the organization with less disruption of mission/business processes. Clustering of multiple ColdFusion servers is a common approach to providing fail-safe application availability when the system criticality requires redundancy.
Fix Text
Navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Create a cluster by defining a name and adding it to the configured clusters. Edit the cluster to add available servers to the cluster and submit the changes to the cluster.
Check Content
This requirement is dependent upon system mission criticality. If the system is not mission critical and does not require redundancy, this finding is not applicable. Within the Administrator Console, navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Verify that there are configured clusters with more than 1 server in each cluster. If there are no clusters defined or there is only one server in the cluster, this is a finding.
ColdFusion must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
Discussion
Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established. The DoD will only accept PKI certificates obtained from a DoD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. The application server must only allow the use of DoD PKI-established certificate authorities for verification. DoD-approved CAs can be found in the “installroot” tool on https://iase.disa.mil or in the Windows certificate store of the Windows Secure Host Baseline image. ColdFusion uses the underlying JVM and keystore for storing and certificates and for use within connections for data transfer. These certificates must be checked to ensure the certificates are from DoD PKI-established certificate authorities.
Fix Text
Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. Remove the certificates that have a CA that is non-DoD approved and import DoD CA-approved certificates.
Check Content
Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. To view the certificates stored within this file, execute the java command keytool -list -v -keystore ./cacerts and verify that the Certificate Authority (CA) for each certificate is DoD-approved. If any certificates have a CA that is not DoD-approved, this is a finding.
ColdFusion, when part of a mission critical system, must be in a high-availability (HA) cluster.
Discussion
A mission critical system is a system that handles data vital to the organization's operational readiness or effectiveness of deployed or contingency forces. A mission critical system must maintain the highest level of integrity and availability. By High Availability (HA) clustering the ColdFusion application server, the hosted application and data are given a platform that is load-balanced and provides high-availability. Most HA clusters consist of two nodes, which is the minimum required for redundancy, but HA clusters can consist of many more nodes. ColdFusion does offer a clustering capability that must be used when the ColdFusion application server is part of a mission critical system.
Fix Text
If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Define two or more servers to be part of each cluster. Once the servers are defined for the cluster(s), navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. Define clusters for your mission critical ColdFusion installation. Each defined cluster must contain two or more servers.
Check Content
If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Validate that two or more servers have been defined and that the servers are on different hosts. If there are fewer than two servers available or the servers are on the same host, this is a finding. Navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. If there are no clusters defined or any cluster has fewer than two servers in the cluster, this is a finding.
ColdFusion must not store user information in the server registry.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to fill the server hard drive with data or to cause registry purges on a large registry. Filling the drive with data can be achieved if applications have client management enabled and client data is stored within the registry. If a scheduled purge is performed on the registry, ColdFusion must load the entire registry into memory and look at each entry to determine if the entry needs to be purged. The purging process can use all of the available memory and 100% of the CPU for a process that may only delete a few entries. Also, the registry is typically located on the system partition. Because of these factors, the use of the registry to store client sessions must not be used.
Fix Text
Navigate to the "Client Variables" page under the "Server Settings" menu. Set the default storage mechanism for client sessions to any available mechanism other than the registry and select the "Apply" button.
Check Content
Within the Administrator Console, navigate to the "Client Variables" page under the "Server Settings" menu. If the default storage mechanism for client sessions is set to "Registry", this is a finding.
ColdFusion must limit the maximum number of Flash Remoting requests.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is Flash Remoting. Flash Remoting is a service that allows flash applications to interact with ColdFusion pages and, if being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When not in use, this setting must be set to 1.
Fix Text
If flash remoting is being used, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Flash Remoting requests" to 1 and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if flash remoting is being used (Note: The Server Monitor feature in ColdFusion Enterprise makes use of flash remoting.). If flash remoting is being used, this finding is not applicable. If "Maximum number of simultaneous Flash Remoting requests" is not set to 1, this is a finding.
ColdFusion must limit the SQL commands available.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Allowing hosted applications to execute SQL commands that create tables, change permissions on objects, create stored procedures, or drop objects allow an attacker to put the hosted application into a posture where it may not work correctly, display error messages that contains sensitive data that was not tested for during development, or cause an application to be unable to authenticate users. Any of these situations puts the system into a situation where the user is denied service to the application. Giving applications only those SQL commands needed to operate on data reduces this risk.
Fix Text
If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. Uncheck the allow SQL of CREATE, GRANT, DROP, REVOKE and ALTER and select the "Submit" button.
Check Content
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. If any of the data sources have CREATE, GRANT, DROP, REVOKE or ALTER checked, this is a finding.
ColdFusion must set a query timeout for Data Sources.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by executing a query that will never return or timeout. By having no timeout set, this type of DoS would be available to an attacker. By setting a value greater than 0 (0 means no timeout), the query would be stopped and the resources released.
Fix Text
If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. If the data source has a query timeout parameter, set the timeout parameter to a value greater than 0 and select the "Submit" button.
Check Content
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. Check to see if the data source has the capability to specify a query timeout. If available, this parameter must not be 0 (No Timeout). If a data source does not have this setting, then this is not a finding for this data source. If any of the data sources have a query timeout set to 0, this is a finding.
ColdFusion must limit the maximum number of Web Service requests.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is Web Services. Web Services are services that allow an application to publish SOAP web services and when being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When not in use, this setting must be set to 1.
Fix Text
If Web Services are being published for hosted applications, this find is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Web Service requests" to 1 and select the "Submit Changes" button.
Check Content
Determine if web services are being published for the hosted applications. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If Web Services are being published for hosted applications, this find is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If Web Services are not being published for hosted applications and the "Maximum number of simultaneous Web Service requests" is not set to 1, this is a finding.
ColdFusion must limit the maximum number of CFC function requests.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is remote ColdFusion Component (CFC) requests. Remote CFC requests allow ColdFusion components to be called directly from an http/https url. If this feature is being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When the feature is not in use, the maximum number must be set to 1.
Fix Text
If CFC requests are being used by hosted applications, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous CFC function requests" to 1 and select the "Submit Changes" button.
Check Content
Determine if CFC functions are being called directly from http/https for any hosted application. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation or ColdFusion baseline documentation. If CFC requests are being used by hosted applications, this finding is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If the CFC requests are not being used by hosted applications and "Maximum number of simultaneous CFC function requests" is not set to 1, this is a finding.
ColdFusion must limit the maximum number of simultaneous Report threads.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Report threads are used to process reports concurrently. Since reporting in most applications is a process that is not time sensitive or heavily used, this setting should be minimized to minimize resource use on the application server and to minimize a method that could be used to exhaust resources by an attacker. Unless reporting is heavily used, the number of simultaneous report threads must be set to 1.
Fix Text
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Report threads" to 1 and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Maximum number of simultaneous Report threads" is not set to 1, this is a finding.
ColdFusion must limit the maximum number of threads available for CFTHREAD.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is the CFTHREAD function. CFTHREAD allows a programmer to create threads of code that execute independently. If this feature is being used, the maximum number of threads should be tuned. If set to high, this may lead to a context-switching situation. When this feature is not in use, the maximum number of threads must be 1.
Fix Text
If threading is being used, this finding is not applicable. Navigate to the "Request Tuning page under the Server Settings" menu. Set "Maximum number of threads available for CFTHREAD" to 1 and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if threading, calls to CFTHREAD, is being used by any of the hosted application. If threading is being used, this finding is not applicable. If threading is not being used and "Maximum number of threads available for CFTHREAD" is not set to 1, this is a finding.
ColdFusion must set a timeout for requests.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. The "Timeout Requests after" setting is used to terminate requests that have not been fulfilled within the set time. This parameter prevents unusually long requests from occupying server resources and impairing performance or denying other requests. This setting is system dependent and may be changed based on the performance capabilities of the underlying system hardware. Unless custom system tuning parameters are required and specifically documented, this value should be set to "5" or less. The vendor also recommends the "Timeout requests waiting in queue after" setting be set to the same value.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Timeout Requests after seconds" and set the value to "5" or to the documented tuned value and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Review system documentation. Determine if the "Timeout Requests after" setting has been tuned to account for application and system performance. If "Timeout Requests after seconds" is not set to "5" or is not set in accordance with the documented tuning parameters, this is a finding.
ColdFusion must set a timeout for logins.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. The "Login Timeout" setting is used to terminate login attempts on data sources that have not been fulfilled in the set time. This parameter prevents unusually long logins from occupying server resources and impairing performance. This value should be set to 5 or less and be less than or equal to the value for "Timeout Requests after" setting.
Fix Text
Navigate to the "Data Sources" page under the "Data & Services" menu. Edit each data source and set the "Login Timeout (sec)" to 5 or less within the advanced settings for the data source.
Check Content
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" menu. If there are no data sources defined, this finding is not applicable. For each Data Source, view the "Login Timeout (sec)" setting within the Advanced Settings for the data source by editing the data source and then pressing the "Show Advanced Settings" button. If there are any data sources with a "Login Timeout (sec)" set higher than 5, this is a finding.
ColdFusion must limit the time-out for requests waiting in the queue.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. By setting a timeout for requests in queue, the queue is kept clear and not filled by requests that can never be filled. If an attacker were able to fill the queue with requests that never expired, the system would eventually fail. For DoD systems, this setting must be set to 5 or lower and should match the "Timeout Requests After" value.
Fix Text
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Timeout requests waiting in queue after" to 5 or less and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Timeout requests waiting in queue after" setting is set higher than 5, this is a finding.
ColdFusion must have a custom request queue time-out page.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Limiting the knowledge given to an attacker about the effects of his attack and possible solutions to further his attack is important. This is especially important when the attacker is trying to find the limits needed to exhaust resources and cause a DoS. To limit feedback to the attacker on his efforts, a custom time-out page should be used. The message returned should only inform the user that they should wait and retry their request again. The message must not disclose that the queue timed out.
Fix Text
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Request Queue Timeout Page" to a custom and valid error page and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Validate that the "Request Queue Timeout Page" setting is set to a valid and custom page. If "Request Queue Timeout Page" is blank or is set to /CFIDE/administrator/templates/request_timeout_error.cfm, this is a finding. If a page is specified, validate that the file exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Request Queue Timeout Page" is set to /CFIDE/administrator/templates/timeout_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/timeout_error.cfm If the "Request Queue Timeout Page" setting is not set to a valid page, this is a finding.
ColdFusion must limit the maximum number of POST requests parameters.
Discussion
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Limiting the number of POST requests to the maximum number of form fields on any given page within the hosted application is used to mitigate the DoS attack known as HashDOS. ColdFusion provides the postParameterLimit setting to address this risk. This is a tunable parameter that should be set as low as the application and the hardware will allow. If the system administrator has not documented and identified the specific setting value based on their specific application and system tuning requirements, this parameter must be set to "50" or less.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Set "Maximum number of POST request parameters" to "50" or to the value specified in the documented tuning parameters and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Review system documentation. Determine if the "Maximum number of POST request parameters" setting has been tuned to account for application and system performance. If "Maximum number of POST request parameters" is not set to "50" or is not set in accordance with documented tuning parameters, this is a finding.
ColdFusion must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
Discussion
Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), but care must also be taken to safeguard against non-FIPS approved SSL versions being used. These older versions contain vulnerabilities that have been addressed in the newer FIPS 140-2 approved TLS releases. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. TLS must be enabled, and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. ColdFusion uses JVM to control the encryption of transmitted data. Settings for JVM can be controlled within the Administrator Console to configure the JVM to only use FIPS 140-2 approved TLS and disable non-FIPS SSL versions.
Fix Text
Navigate to the "JVM arguments" setting within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. Add the parameter -Dhttps.protocols and set the parameter to the TLS versions to be used. A sample setting to use TLSv1.2, TLSv1.1 and TLSv1 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1. SSL versions must not be added to this parameter. Once the parameter is added to the JVM arguments, select the "Submit Changes" button to save the changes and restart the ColdFusion application server to have the changes take effect.
Check Content
Review the setting "JVM arguments" within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. The parameter -Dhttps.protocols is used to set the TLS versions that the JVM can use. Valid values for this setting must be TLS versions 1.0 or higher. An example settings to use TLS versions 1.2, 1.1 and 1.0 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 and an example to only use TLS version 1.2 is -Dhttps.protocols=TLSv1.2 If the "JVM arguments" setting does not contain the parameter -Dhttps.protocols or if the parameter -Dhttps.protocols contains any SSL versions, this is a finding.
ColdFusion must encrypt cookies.
Discussion
Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). Transmission of session cookies is especially important since an attacker can grab the session id and hijack the already authenticated session. There are several methods to protect cookie data, and one of those methods is to encrypt the cookie. This can only be done if all the hosted sites are SSL/TLS enabled.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Secure Cookie" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Secure Cookie" is not checked, this is a finding.
ColdFusion must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
Discussion
Preventing the disclosure or modification of transmitted information requires that application servers take measures to employ approved cryptography in order to protect the information during transmission over the network. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSec tunnel. If data in transit is unencrypted, it is vulnerable to disclosure and modification. If approved cryptographic algorithms are not used, encryption strength cannot be assured. ColdFusion uses the underlying JVM to handle transmission and receiving of data, but ColdFusion does offer to the programmer an encrypt API call to protect the data. This call can use multiple crypto methods, but using FIPS 140-2 is superior to those non-FIPS crypto methods to protect and detect changes to the data. Through JVM arguments set within ColdFusion, the programmer can be forced to only FIPS crypto methods.
Fix Text
Navigate to the "Java and JVM" page under the "Server Settings" menu. Locate the JVM argument coldfusion.enablefipscrypto. If the argument cannot be found, add the argument as -Dcoldfusion.enablefipscrypto=true. If the parameter is defined but set to false, change the setting to true.
Check Content
Within the Administrator Console, navigate to the "Java and JVM" page under the "Server Settings" menu. If the JVM argument-Dcoldfusion.enablefipscrypto=true cannot be found or -Dcoldfusion.enablefipscrypto is set to false, this is a finding.
ColdFusion must encrypt patch retrieval.
Discussion
Checking for patches and downloading those patches for installation must be done through an encrypted connection to protect the patch from modification during transmission and to avoid spoofed updates.
Fix Text
If the Administrator Console is used for patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console. Locate the "Site URL" setting on the "Settings" tab. Update the URL used for updates to be prefixed with https:// so that the communication is encrypted and select the "Submit Changes" button. If a manual process is used to retrieve patches, document the process to retrieve the patches that uses an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc.
Check Content
If the Administrator Console is used to perform patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console and review the setting "Site URL" within the "Settings" tab. If the URL is not prefixed by https://, this is a finding. If a manual process is used to retrieve patches, verify that a documented process is in place that includes using an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc. If there is not a documented process or the process does not include an encrypted method to download patches, this is a finding.
ColdFusion must protect Session Cookies from being read by scripts.
Discussion
A cookie can be read by client-side scripts easily if cookie properties are not set properly during preparation for transmission. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HTTPOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
Fix Text
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "HTTPOnly" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "HTTPOnly" is unchecked, this is a finding.
ColdFusion must prevent JavaScript Object Notation (JSON) hijacking of data.
Discussion
Information can be either unintentionally or maliciously disclosed if not protected during preparation for transmission. An easy way to protect data during preparation for transmission is to use non-default identifiers for data. An example is for JavaScript Object Notation (JSON) to use a prefix other than the default "JSON" prefix, signifying to an attacker an array of data is following. JSON is a lightweight data-interchange format.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Prefix serialized JSON with" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Prefix serialized JSON with" is unchecked, this is a finding.
ColdFusion must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.
Discussion
Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DoD or CNS creates an integrity risk. The application server must utilize approved DoD or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions. ColdFusion uses an underlying JVM for communication and certificate storage. To validate that the proper certificates are in use, the keystore must be checked.
Fix Text
Request a CNSS or DoD Class 3 or Class 4 certificate and add it to the keystore to be used for PKI communication.
Check Content
Interview the administrator to determine if ColdFusion is using certificates for PKI. If ColdFusion is not performing any PKI functions, this finding is not applicable. The CA certs are usually stored in a file called cacerts located in the directory $JAVA_HOME/jre/lib/security. If the file is not in this location, use a search command to locate the file or ask the administrator where the certificate store is located. Open a dos shell or terminal window and change to the location of the certificate store. To view the certificates within the certificate store, run the command (In this example, the keystore file is cacerts.): keytool -list -v -keystore cacerts Locate the "OU" field for each certificate within the keystore. The field should contain either DoD or CNSS as the Organizational Unit (OU). If the OU does not show that the certificates are DoD or CNSS supplied, this is a finding.
The ColdFusion missing template handler must be valid.
Discussion
The structure and content of error messages need to be carefully considered by the organization and development team. Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The missing template handler is used much like the 404 handler for a web server. When the missing template handler is blank, a potential attacker may be sent information that reveals the ColdFusion version number. Once the attacker has the version of ColdFusion being used, he can begin looking for specific attacks the version may be vulnerable to if not patched and secured properly.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Specify a valid handler for missing templates and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Missing Template Handler" setting is not blank and that the template specified is a valid. If the "Missing Template Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Missing Template Handler" is set to /CFIDE/administrator/templates/missing_template_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/missing_template_error.cfm If the "Missing Template Handler" setting is not a valid file, this is a finding.
The ColdFusion site-wide error handler must be valid.
Discussion
The structure and content of error messages need to be carefully considered by the organization and development team. Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. When the site-wide error handler is blank, information can be presented to an attacker that may expose the cause of exceptions. Having this information, the attacker can then begin attacking this error trying to get the server to fail and cause a DoS, expose PII, or gain access to server resources. A custom site-wide error handler should be created and used that discloses the same generic message to the user for all exceptions and the error must be logged so that the error can be investigated.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Specify a custom and valid site-wide error handler and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Site-wide Error Handler" setting is not blank and that the template specified is valid. If the "Site-wide Error Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web server's document root is /opt/webserver/wwwroot and the "Site-wide Error Handler" is set to /CFIDE/administrator/templates/secure_profile_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/secure_profile_error.cfm If the "Site-wide Error Handler" setting is not a valid file, this is a finding.
ColdFusion must have Robust Exception Information disabled.
Discussion
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. ColdFusion is a development and deployment framework. To handle this role properly, ColdFusion offers several debugging and logging facilities that must be disabled in a production environment. If left enabled, these settings can expose sensitive data within error and log messages.
Fix Text
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Robust Exception Information" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Robust Exception Information" is checked, this is a finding.
ColdFusion must have AJAX Debug Log Window disabled.
Discussion
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. Allowing the AJAX Debug Log Window to be enabled allows a user to send AJAX debug messages back to a client. The log data sent is meant to be used in a development environment and used to fix errors in AJAX code. Once the application is developed and is moved to production, debugging is not needed and this feature must be disabled.
Fix Text
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable AJAX Debug Log Window" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable AJAX Debug Log Window" is checked, this is a finding.
ColdFusion must have Request Debugging Output disabled.
Discussion
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. The option to enable request debugging output is another tool that a developer can use during the development phase of the hosted application. This feature appends debugging information to the end of each CFML request. Once a hosted application is moved from the development phase to production, the need for debug information is no longer valid.
Fix Text
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Request Debugging Output" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Request Debugging Output" is checked, this is a finding.
ColdFusion must have Allow Line Debugging disabled.
Discussion
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. The option to allow line debugging is enabled when a developer wants to trace code through a debugger such as Eclipse. Debugging must not be performed on a production server, and this option must be disabled.
Fix Text
Navigate to the "Debugger Settings" page under the "Debugging & Output Settings" menu. Uncheck "Allow Line Debugging" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Debugger Settings" page under the "Debugging & Output Settings" menu. If "Allow Line Debugging" is checked, this is a finding.
The ColdFusion error messages must be restricted to only authorized users.
Discussion
If the application provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Application servers must protect the error messages that are created by the application server. All application server users' accounts are used for the management of the server and the applications residing on the application server. All accounts are assigned to a certain role with corresponding access rights. The application server must restrict access to error messages so only authorized users may view them. Error messages are usually written to logs contained on the file system. The application server will usually create new log files as needed and must take steps to ensure that the proper file permissions are utilized when the log files are created.
Fix Text
Navigate to the "User Manager" page under the "Security" menu. Remove the "Debugging and Logging>Logging" role from each user that should not have access to read error messages.
Check Content
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user and ask the SA if the user should have access to read error messages. For each user that should not be able to read error messages, review the roles assigned to the user account. If any user has the Debugging and Logging>Logging role that should not be able to read error messages, this is a finding.
ColdFusion must have ColdFusion component (CFC) type checking enabled.
Discussion
Invalid user input occurs when a user inserts data or characters into an application's data entry field and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. Invalid input can also occur within applications to ColdFusion components. The parameters can be input from users that are not properly type checked or from data computed within the application. When the data is not type checked, the receiving component may cause an error that is unhandled or throw an exception that puts the application server and/or hosted application into an unsecure posture. To limit invalid calls, ColdFusion component (CFC) type checking must be disabled.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Disable CFC Type check" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Disable CFC Type check" is checked, this is a finding.
ColdFusion must enable Global Script Protection.
Discussion
Invalid user input occurs when a user inserts data or characters into an application's data entry field and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. Invalid inputs are also used for Cross-Site Scripting (XSS) attacks. This type of attack relies on the attacker being able to insert script code into an input field and having the script executed on the client machine. By enabling Global Script Protection, there is a very limited protection against certain Cross-Site Scripting attack vectors. It is important to understand that enabling this setting does not protect hosted applications from all possible Cross-Site Scripting attacks. When this setting is turned on, it uses a regular expression defined in the file neo-security.xml to replace input variables containing the following tags: object, embed, script, applet, and meta with Invalid Tag. This setting does not restrict any JavaScript strings that may be injected and executed, iframe tags, or any XSS obfuscation techniques.
Fix Text
Navigate to the "Settings" page under the "Server Settings" menu. Check "Enable Global Script Protection" and select the "Submit Changes" button.
Check Content
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Enable Global Script Protection" is unchecked, this is a finding.
ColdFusion must remove software components after updated versions have been installed.
Discussion
Installation of patches and updates is performed when there are errors or security vulnerabilities in the current release of the software. When previous versions of software components are not removed from the application server after updates have been installed, an attacker may use the older components to exploit the system. ColdFusion creates a backup directory for an update when installed. This backup directory allows the SA to uninstall the update if an error occurs or incompatibility is found with the hosted applications. Once the update is tested and found to work correctly, the backup directory must be removed so that the update cannot be uninstalled.
Fix Text
Navigate to the "Updates" page under the "Server Update" menu within the Administrator Console. Within the "Installed Updates" tab, locate the backup directory location for any updates installed. On the server running the ColdFusion server, remove all backup directories for any updates installed. Note: Do not remove the backup directory for an update until the update has been tested and verified that the ColdFusion server is operating correctly.
Check Content
Within the Administrator Console, navigate to the "Updates" page under the "Server Update" menu. Within the "Installed Updates" tab, locate the backup directory location for each update that is installed. On the server running the ColdFusion server, verify that the backup directories do not exist for any of the updates. If all updates have been tested/verified and any of the backup directories exist, this is a finding. Note: Do not remove the backup directory for an update until the update has been tested and verified that the ColdFusion server is operating correctly.
ColdFusion must be set to automatically check for updates.
Discussion
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. To configure the software to discover that a new patch is available is important since administrators may be responsible for multiple servers running different applications and services, making it difficult for the administrator to constantly check for updates. Enabling the automatic check informs the administrator, allows him to investigate the patch and what is needed to apply the patch and schedule any outages that might be needed, thereby permitting the patch to be installed quickly and efficiently. Having "Automatically Check for Updates" checked causes ColdFusion to look for updates on every logon.
Fix Text
If the ColdFusion server has access to a patch repository, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and check the "Automatically Check for Updates" setting and select the "Submit Changes" button. If the ColdFusion server does not have access to a patch repository, document the process to check for updates. The documented process must include location and how often.
Check Content
Determine if the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository. This may be determined by interviewing the administrator or by reviewing ColdFusion baseline documentation. If the ColdFusion server has access to a patch repository, the server must check for updates. To verify that the server is checking for updates, within the Administrator Console, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and verify that the "Automatically Check for Updates" is checked. If the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository and "Automatically Check for Updates" is not checked, this is a finding. If the ColdFusion server does not have access to Adobe or an internally maintained patch repository, then a manual process must be documented to check for updates. The documented process must include the location and how often to check for updates. If the process is not documented or the documented process does not include location and frequency, this is a finding.
ColdFusion must have notifications enabled when a server update is available.
Discussion
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. To configure the software to discover that a new patch is available is important since administrators may be responsible for multiple servers running different applications and services, making it difficult for the administrator to constantly check for updates. Enabling the automatic check informs the administrator, allows him to investigate the patch and what is needed to apply the patch and schedule any outages that might be needed, thereby permitting the patch to be installed quickly and efficiently. Having "Check for updates every" checked causes ColdFusion to look for updates every set number of days. Entering a list of email addresses to notify guarantees a notification is sent to the administrator.
Fix Text
If the ColdFusion server has access to a patch repository, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and check the "Check for updates every" setting, enter a value greater than 0 for the "days" setting, and enter email addresses for notification. Select the "Submit Changes" button to save the new settings. If the ColdFusion server does not have access to a patch repository, document the process to enroll into the Adobe patch notification service and enroll all administrators in the notification service.
Check Content
Determine if the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository. This may be determined by interviewing the administrator or by reviewing ColdFusion baseline documentation. If the ColdFusion server has access to a patch repository, the server must notify administrators when updates are available. To verify that the server is notifying administrators, within the Administrator Console, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and verify that the "Check for updates every" is checked, that a positive value is entered for the "days" value and that at least one email address is entered for notification. If "Check for updates every" is not checked, the "days" value is empty or less than 1, or the "If updates are available, send email notification to" parameter is empty, this is a finding. If the ColdFusion server does not have access to a patch repository, then a documented notification process must be in place along with the administrator's enrollment in the Adobe automated patch notification service. To validate enrollment, a verification email or patch notification email can be used. If the administrators are not enrolled in the Adobe patch notification service or the process is not documented, this is a finding.