ColdFusion Security [closed]

https://stackoverflow.com/questions/2472211

20-09-2019
|

Question

What are the best practices for securing a coldfusion webpage from malicious users? (including, but not limited to, sql injection attacks)

Is cfqueryparam enough?

Solution

I use a modified portcullis, and filter all incoming var scopes (URL,FORM,COOKIE) onRequestStart. http://portcullis.riaforge.org/

OTHER TIPS

Pete Freitag has an awesome blog, especially this post on Hardening ColdFusion

I would say best practices for ColdFusion are similar to those for programming web applications in any language.

I recently read Essential PHP Security Chris Shiflett and the majority of issues discussed affect ColdFusion as well, though the syntax for dealing with them may be slightly different. I expect there are other (possibly better) language agnostic books which contain principles which can easily be altered for use in ColdFusion.

Although using a prebuilt solution will work, I recommend knowing all the possible issues that must be protected. Check out Hack Proofing ColdFusion at Amazon.

Another great place to learn about security (and all kinds of other topics) is to check out Charlie Arehart's massive list of recorded user group presentations: http://www.carehart.org/ugtv/

Never trust the client.

The most ColdFusion specific "set and forget" is following server administrator hardening guidelines noted above, keeping the server up-to-date, and following ColdFusion on twitter to learn about any new issues immediately.

For app security, which is common across all languages, you should validate every piece of information that touches your server from the client. Forms are are obvious areas of tight control, but don't forget about URL parameters that you might use for application state management or control. Something like &startRow=10&tag=security which isn't "supposed" to be touched by the user is user input. Even if your application could never break with invalid data, you might not know how that data will be used in the future. Validation could be as simple as ensuring that someone isn't entering a 100 character long first name and doesn't contain programming characters or ensuring that &startRow is always a number. These are the little things that application developers sometimes skip because everything works OK as long as you are using the software as expected.

I believe you can look at the Sony Playstation hacking as an example. Unfortunately, they didn't expect someone to hack the client (playstation console) and manipulate the PlayStation console software to hack the server. The server trusted the client.

Never trust the client.

Here is information on a good tool that can be used to prevent XSS.

https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project

http://www.petefreitag.com/item/760.cfm

Fairly easy to implement and Java based.

I recommend you the excellent talk by Justin McLean "ColdFusion Security and Risk Management". It includes a case study.

PDF presentation http://cdn.classsoftware.com/talks/CFMeetupSecurity.pdf

Video streaming: http://experts.adobeconnect.com/p22718297

CfQueryParam is very important, but not nearly enough.

There is a boxed solution we use at my work: http://foundeo.com/security/. It covers most of the bases. And even if you don't want to buy it, you can take a look at it's feature set and get an idea of the things you should be considering.