Adobe ColdFusion 11 Security Technical Implementation Guide
- Version/Release: V2R1
- Published: 2021-06-22
-
Expand All:
- Severity:
-
Sort:
Compare
Select any two versions of this STIG to compare the individual requirements
View
Select any old version/release of this STIG to view the previous requirements
- RMF Control
- AC-10
- Severity
- Low
- CCI
- CCI-000054
- Version
- CF11-01-000001
- Vuln IDs
-
- V-237137
- V-62075
- Rule IDs
-
- SV-237137r641506_rule
- SV-76565
Checks: C-40356r641504_chk
Within the Administrator Console, navigate to the "Administrator" settings under the "Security" menu. If the setting "Allow concurrent login sessions for Administrator Console" is checked, this is a finding.
Fix: F-40319r641505_fix
Within the Administrator Console, navigate to the "Administrator" settings under the "Security" menu. To disable concurrent logins, uncheck the "Allow concurrent login sessions for Administrator Console" setting and select the "Submit Changes" button.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001453
- Version
- CF11-01-000004
- Vuln IDs
-
- V-237138
- V-62349
- Rule IDs
-
- SV-237138r641509_rule
- SV-76839
Checks: C-40357r641507_chk
Access the "PDF Service" page under the "Data & Services" menu within the Administrator Console. If there are no PDF Service Managers defined, the finding is not applicable. If any PDF Service Managers listed have "Https Enabled" set to "NO", this is a finding.
Fix: F-40320r641508_fix
If there are no PDF Service Managers in use, the finding is not applicable. Access the "PDF Service" page under the "Data & Services" menu within the Administrator Console. Edit each service and check the "Https Enabled" option.
- RMF Control
- AC-17
- Severity
- High
- CCI
- CCI-001453
- Version
- CF11-01-000005
- Vuln IDs
-
- V-237139
- V-62351
- Rule IDs
-
- SV-237139r641512_rule
- SV-76841
Checks: C-40358r641510_chk
Review the setting "JVM arguments" within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. The parameter -Dhttps.protocols is used to set the TLS versions that the JVM can use. Valid values for this setting must be TLS versions 1.0 or higher. An example setting to use TLS versions 1.2, 1.1 and 1.0 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 and an example to only use TLS version 1.2 is -Dhttps.protocols=TLSv1.2 If the "JVM arguments" setting does not contain the parameter -Dhttps.protocols or if the parameter -Dhttps.protocols contains any SSL versions, this is a finding.
Fix: F-40321r641511_fix
Navigate to the "JVM arguments" setting within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. Add the parameter -Dhttps.protocols and set the parameter to the TLS versions to be used. A sample setting to use TLSv1.2, TLSv1.1 and TLSv1 is - Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1. SSL versions must not be added to this parameter. Once the parameter is added to the JVM arguments, select the "Submit Changes" button to save the changes and restart the ColdFusion application server to have the changes take effect.
- RMF Control
- AC-3
- Severity
- Medium
- CCI
- CCI-000213
- Version
- CF11-01-000007
- Vuln IDs
-
- V-237140
- V-62353
- Rule IDs
-
- SV-237140r641515_rule
- SV-76843
Checks: C-40359r641513_chk
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review the roles assigned to each user against the ISSM approved list of user accounts and roles to determine if any user has excessive authorization. If any user has roles assigned that are not approved by the ISSM, this is a finding.
Fix: F-40322r641514_fix
Navigate to the "User Manager" page under the "Security" menu and review the roles assigned to each user. Enable only those roles for each user approved by the ISSO/ISSM.
- RMF Control
- AC-12
- Severity
- Medium
- CCI
- CCI-002361
- Version
- CF11-01-000010
- Vuln IDs
-
- V-237141
- V-62355
- Rule IDs
-
- SV-237141r641518_rule
- SV-76845
Checks: C-40360r641516_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If the "Session Variables" setting under the "Default Timeout" section is set greater than 15 minutes, this is a finding.
Fix: F-40323r641517_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the "Session Variables" setting under the "Default Timeout" section to 15 minutes or less and select the "Submit Changes" button.
- RMF Control
- AC-12
- Severity
- Medium
- CCI
- CCI-002361
- Version
- CF11-01-000011
- Vuln IDs
-
- V-237142
- V-62357
- Rule IDs
-
- SV-237142r641521_rule
- SV-76847
Checks: C-40361r641519_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If the "Session Variables" setting under the "Maximum Timeout" section is set greater than "1" hour, this is a finding.
Fix: F-40324r641520_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the "Session Variables" setting under the "Maximum Timeout" section to "1" hour or less and select the "Submit Changes" button.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-002314
- Version
- CF11-01-000016
- Vuln IDs
-
- V-237143
- V-62359
- Rule IDs
-
- SV-237143r641524_rule
- SV-76849
Checks: C-40362r641522_chk
Within the Administrator Console, navigate to the "Allowed IP Addresses" page under the "Security" menu. If the list of allowed IP addresses for accessing the ColdFusion Administrator is blank, is set to "*.*.*.*" or contains IP addresses/subnets that should not have access, this is a finding.
Fix: F-40325r641523_fix
Navigate to the "Allowed IP Addresses" page under the "Security" menu. Set the list of allowed IP addresses for accessing ColdFusion Administrator to only those IP addresses or subnets that should be capable of reaching the Administrator Console.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-002314
- Version
- CF11-01-000017
- Vuln IDs
-
- V-237144
- V-62361
- Rule IDs
-
- SV-237144r641527_rule
- SV-76851
Checks: C-40363r641525_chk
Within the Administrator Console, navigate to the "Allowed IP Addresses" page under the "Security" menu. If there are any entries in the "Allowed IP Addresses for Exposed Services" section, validate with the SA that the IP addresses and subnets specified require access. If any of the IP addresses or subnets specified do not require access, this is a finding.
Fix: F-40326r641526_fix
Navigate to the "Allowed IP Addresses" page under the "Security" menu. Remove all entries from the list under the "Allowed IP Addresses for Exposed Services" section that do not require access to ColdFusion services.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-002314
- Version
- CF11-01-000018
- Vuln IDs
-
- V-237145
- V-62363
- Rule IDs
-
- SV-237145r641530_rule
- SV-76853
Checks: C-40364r641528_chk
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user by using the edit function. For each user that has values for "Allowed Services", validate with the SA that the user should have remote access to each service. If there are any users with services that are not required to perform the users' duties, this is a finding.
Fix: F-40327r641529_fix
Navigate to the "User Manager" page under the "Security" menu. Only assign services to those users who require access and only assign those services that are required to perform the user's duties.
- RMF Control
- AU-10
- Severity
- High
- CCI
- CCI-000166
- Version
- CF11-02-000030
- Vuln IDs
-
- V-237146
- V-62365
- Rule IDs
-
- SV-237146r641533_rule
- SV-76855
Checks: C-40365r641531_chk
Access the "Administrator" page under the "Security" menu within the Administrator Console. If the "Separate user name and password authentication" is not selected, this is a finding.
Fix: F-40328r641532_fix
Access the "Administrator" page under the "Security" menu within the Administrator Console. Select "Separate user name and password authentication" and select the "Submit Changes" button.
- RMF Control
- AU-10
- Severity
- Medium
- CCI
- CCI-000166
- Version
- CF11-02-000031
- Vuln IDs
-
- V-237147
- V-62367
- Rule IDs
-
- SV-237147r641536_rule
- SV-76857
Checks: C-40366r641534_chk
Review the users within the "User Manager" page under the "Security" menu. If users are not defined, this is a finding.
Fix: F-40329r641535_fix
Create user accounts within the "User Manager" page under the "Security" menu for those users that need access to the Administrator Console.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000174
- Version
- CF11-02-000032
- Vuln IDs
-
- V-237148
- V-62369
- Rule IDs
-
- SV-237148r641539_rule
- SV-76859
Checks: C-40367r641537_chk
Determine if ColdFusion is part of a clustered environment by accessing the "Instance Manager" and the "Cluster Manager" settings under the "Enterprise Manager" menu within the Administrator Console. If ColdFusion is not setup in a clustered configuration, this finding is not applicable. Ask the SA if a log record aggregation tool is being used to compile the log records from the ColdFusion application servers within the cluster for storage and review. If the log records are not being aggregated, this is a finding.
Fix: F-40330r641538_fix
Implement a strategy to aggregate the log data from the ColdFusion application servers within the cluster for system-wide log trail storage and review.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000171
- Version
- CF11-02-000034
- Vuln IDs
-
- V-237149
- V-62371
- Rule IDs
-
- SV-237149r641542_rule
- SV-76861
Checks: C-40368r641540_chk
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only the ISSM, or users appointed by the ISSM to change logable events, may have the following roles: Debugging and Logging>Logging Debugging and Logging>Code Analyzer Debugging and Logging>Debugging Debugging and Logging>License Scanner Debugging and Logging>System Probes If any other users have any of these roles, then this is a finding.
Fix: F-40331r641541_fix
Navigate to the "User Manager" page under the "Security" menu and assign the following roles to the ISSM and users appointed by the ISSM to change logable events. Debugging and Logging>Logging Debugging and Logging>Code Analyzer Debugging and Logging>Debugging Debugging and Logging>License Scanner Debugging and Logging>System Probes
- RMF Control
- AU-3
- Severity
- Low
- CCI
- CCI-000132
- Version
- CF11-02-000040
- Vuln IDs
-
- V-237150
- V-62373
- Rule IDs
-
- SV-237150r641545_rule
- SV-76863
Checks: C-40369r641543_chk
Within the Administrator Console, navigate to the "Logging Settings" page under the "Debugging & Logging" menu. If "Enable logging for scheduled tasks" is not checked, this is a finding.
Fix: F-40332r641544_fix
Navigate to the "Logging Settings" page under the "Debugging & Logging" menu. Check "Enable logging for scheduled tasks" and select the "Submit Changes" button.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- CF11-02-000049
- Vuln IDs
-
- V-237151
- V-62375
- Rule IDs
-
- SV-237151r641548_rule
- SV-76865
Checks: C-40370r641546_chk
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only users given the responsibility to read logs should have the following role assigned: Debugging and Logging>Logging If any user, other than those assigned to read logs, is assigned this role, this is a finding.
Fix: F-40333r641547_fix
Enable the Debugging and Logging>Logging role for those users that require the ability to read log files. This parameter is set in the "User Manager" page under the "Security" menu.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- CF11-02-000050
- Vuln IDs
-
- V-237152
- V-62377
- Rule IDs
-
- SV-237152r641551_rule
- SV-76867
Checks: C-40371r641549_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
Fix: F-40334r641550_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object". 9. Click "OK" to apply these permissions. ColdFusion running on Linux Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000163
- Version
- CF11-02-000051
- Vuln IDs
-
- V-237153
- V-62379
- Rule IDs
-
- SV-237153r641554_rule
- SV-76869
Checks: C-40372r641552_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
Fix: F-40335r641553_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000164
- Version
- CF11-02-000052
- Vuln IDs
-
- V-237154
- V-62381
- Rule IDs
-
- SV-237154r641557_rule
- SV-76871
Checks: C-40373r641555_chk
Review the roles assigned to the defined users within the "User Manager" page under the "Security" menu. Only users given the responsibility to delete logs should have the Debugging and Logging>Logging role assigned. If any user, other than those assigned the capability to delete logs, is assigned this role, this is a finding.
Fix: F-40336r641556_fix
Enable the Debugging and Logging>Logging role for those users that require the ability to delete log files. This parameter is set in the "User Manager" page under the "Security" menu.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000164
- Version
- CF11-02-000053
- Vuln IDs
-
- V-237155
- V-62383
- Rule IDs
-
- SV-237155r641560_rule
- SV-76873
Checks: C-40374r641558_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. ColdFusion running on Linux should have the permissions set to "750" or more restrictive. If the permissions are not set correctly for the log directory and log files, this is a finding.
Fix: F-40337r641559_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly. For example, if the log directory is located at /opt/cf11/cfusion/logs, the command would be: chmod -R 750 /opt/cf11/cfusion/logs
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-001348
- Version
- CF11-02-000057
- Vuln IDs
-
- V-237156
- V-62385
- Rule IDs
-
- SV-237156r641563_rule
- SV-76875
Checks: C-40375r641561_chk
This feature is not present when ColdFusion is installed on Windows; therefore, this finding is not applicable. Within the Administrator Console, navigate to the "Logging Settings" page under the "Debugging & Logging" menu. If "Use operating system logging facilities" is not checked, this is a finding.
Fix: F-40338r641562_fix
Navigate to the "Logging Settings" page under the "Debugging & Logging" menu. Check "Use operating system logging facilities" and select the "Submit Changes" button.
- RMF Control
- AU-4
- Severity
- Medium
- CCI
- CCI-001849
- Version
- CF11-02-000064
- Vuln IDs
-
- V-237157
- V-62387
- Rule IDs
-
- SV-237157r641566_rule
- SV-76877
Checks: C-40376r641564_chk
Locate the log file directory by viewing the "Log directory" setting within the "Logging Settings" page under the "Debugging & Logging" menu. Also make note of the "Maximum number of archives" and "Maximum file size (in kilobytes)" settings. Next, view the number of log files generated. This can be found by accessing the "Log Files" page under the "Debugging & Logging" menu. Count the number of log files. If "Maximum number of archives" multiplied by "Maximum file size (in kilobytes)" multiplied by the number of log files is larger than the storage where the log directory is located, this is a finding.
Fix: F-40339r641565_fix
Move the location of the log files to a directory that has sufficient storage to meet the organization-defined log record storage requirement.
- RMF Control
- AU-4
- Severity
- Medium
- CCI
- CCI-001851
- Version
- CF11-02-000065
- Vuln IDs
-
- V-237158
- V-62389
- Rule IDs
-
- SV-237158r641569_rule
- SV-76879
Checks: C-40377r641567_chk
Locate the log file directory by viewing the "Log directory" setting within the "Logging Settings" page under the "Debugging & Logging" menu. Have the administrator show the scheduled task or log management application that accesses this directory and stores the log files to another system or media. If the administrator cannot demonstrate that the log files are being stored to another system or media, this is a finding.
Fix: F-40340r641568_fix
Configure a scheduled task or log management application to store the log files to another system or media.
- RMF Control
- AU-4
- Severity
- Medium
- CCI
- CCI-001851
- Version
- CF11-02-000079
- Vuln IDs
-
- V-237159
- V-62391
- Rule IDs
-
- SV-237159r641572_rule
- SV-76881
Checks: C-40378r641570_chk
Interview the administrator to determine whether or not ColdFusion logs are transferred to another system weekly for standalone systems and simultaneously for interconnected systems. If the logs are not transferred weekly for standalone systems and simultaneously for interconnected systems, this is a finding.
Fix: F-40341r641571_fix
Implement a strategy that transfers logs weekly for standalone systems and simultaneously for interconnected systems.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- CF11-02-000080
- Vuln IDs
-
- V-237160
- V-62393
- Rule IDs
-
- SV-237160r641575_rule
- SV-76883
Checks: C-40379r641573_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have Full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
Fix: F-40342r641574_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000163
- Version
- CF11-02-000081
- Vuln IDs
-
- V-237161
- V-62395
- Rule IDs
-
- SV-237161r641578_rule
- SV-76885
Checks: C-40380r641576_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
Fix: F-40343r641577_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000164
- Version
- CF11-02-000082
- Vuln IDs
-
- V-237162
- V-62397
- Rule IDs
-
- SV-237162r641581_rule
- SV-76887
Checks: C-40381r641579_chk
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log files should have the following permissions: ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion. No other users should have permissions. ColdFusion running on Linux must have group ownership set to "root" and the owner set to the user running ColdFusion. If the ownership of the log directory and log files is incorrect, this is a finding.
Fix: F-40344r641580_fix
Locate the logs directory for ColdFusion. The location can be found in the Administrator Console within the "Logging Settings" page under the "Debugging & Logging" menu. The log directory and log file permissions can be set by: ColdFusion running on Windows: 1. Right click on the logs directory for ColdFusion and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chown command to set the owner and group. For example, if the log directory is located at /opt/cf11/cfusion/logs and the owner is to be cfuser, the command would be: chown -R cfuser:root /opt/cf11/cfusion/logs
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- CF11-03-000091
- Vuln IDs
-
- V-237163
- V-62399
- Rule IDs
-
- SV-237163r641584_rule
- SV-76889
Checks: C-40382r641582_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Disable access to internal ColdFusion Java components" is unchecked, this is a finding.
Fix: F-40345r641583_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable access to internal ColdFusion Java components" and select the "Submit Changes" button.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- CF11-03-000092
- Vuln IDs
-
- V-237164
- V-62401
- Rule IDs
-
- SV-237164r641587_rule
- SV-76891
Checks: C-40383r641585_chk
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user and ask the SA if the user should have access to server patch management functions. For each user that should not be able to access patch management functions, review the roles assigned to the user account. If the user has the "Server Updates" role, this is a finding.
Fix: F-40346r641586_fix
Navigate to the "User Manager" page under the "Security" menu. Remove the "Server Updates" role from each user that should not have access to patch management functions.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- CF11-03-000093
- Vuln IDs
-
- V-237165
- V-62403
- Rule IDs
-
- SV-237165r641590_rule
- SV-76893
Checks: C-40384r641588_chk
Locate the hf-updates directory for ColdFusion. Review the permissions on the hf-updates directory. ColdFusion running on Windows should have full control for the Administrators group and the user running the ColdFusion application. No other users or groups should have permissions. If permissions are granted to other users or groups, this is a finding. If ColdFusion is installed on Linux, the permissions must be "750" or more restrictive with the owner set to the user running the ColdFusion service and a group of root. If the permissions are more permissive, this is a finding.
Fix: F-40347r641589_fix
Locate the hf-updates directory for ColdFusion. The hf-updates directory should have the following permissions: ColdFusion running on Windows: 1. Right click on the "hf-updates" directory and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click "Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly and chown to set the owner and group. For example, if the hf-updates directory is found at /opt/cf11/cfusion/hf-updates and you want to set the owner to cfuser, the commands would be: chown cfuser:root /opt/cf11/cfusion/hf-updates chmod 750 /opt/cf11/cfusion/hf-updates
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000096
- Vuln IDs
-
- V-237166
- V-62405
- Rule IDs
-
- SV-237166r641593_rule
- SV-76895
Checks: C-40385r641591_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allowed file extensions for CFInclude tag" is empty, this is not a finding. If the "Allowed file extensions for CFInclude tag" contains the wildcard string "*.*" or if the list of file extensions is not the list approved by the ISSO, this is a finding.
Fix: F-40348r641592_fix
Navigate to the "Settings" page under the "Server Settings" menu. Enter the list of approved file extensions in the "Allowed file extensions for CFInclude tag" field and select the "Submit Changes" button. A blank list will only allow cfm and cfml files to be included and fulfills this requirement.
- RMF Control
- CM-7
- Severity
- High
- CCI
- CCI-000381
- Version
- CF11-03-000097
- Vuln IDs
-
- V-237167
- V-62407
- Rule IDs
-
- SV-237167r641596_rule
- SV-76897
Checks: C-40386r641594_chk
Ask the administrator if ColdFusion server monitoring is being used or if flex remoting is being used by any hosted applications. If ColdFusion server monitoring is being used or hosted applications are using flash remoting, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If the "Enable Flash Remoting" option is checked, this is a finding.
Fix: F-40349r641595_fix
Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck the "Enable Flash Remoting" option and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000098
- Vuln IDs
-
- V-237168
- V-62409
- Rule IDs
-
- SV-237168r641599_rule
- SV-76899
Checks: C-40387r641597_chk
Ask the administrator if the in-memory file system is being used by any hosted applications. If hosted applications are using the in-memory file system, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Enable In-Memory File System" is checked, this is a finding.
Fix: F-40350r641598_fix
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Enable In-Memory File System" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000099
- Vuln IDs
-
- V-237169
- V-62411
- Rule IDs
-
- SV-237169r641602_rule
- SV-76901
Checks: C-40388r641600_chk
Ask the administrator if Event Gateway services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Event Gateways" menu. If "Enable ColdFusion Event Gateway Services" is checked, this is a finding.
Fix: F-40351r641601_fix
Navigate to the "Settings" page under the "Event Gateway" menu. Uncheck "Enable ColdFusion Event Gateway Services" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- High
- CCI
- CCI-000381
- Version
- CF11-03-000100
- Vuln IDs
-
- V-237170
- V-62413
- Rule IDs
-
- SV-237170r641605_rule
- SV-76903
Checks: C-40389r641603_chk
Within the Administrator Console, navigate to the "RDS" page under the "Security" menu. If "Enable RDS Service" is checked, this is a finding.
Fix: F-40352r641604_fix
Navigate to the "RDS" page under the "Security" menu. Uncheck "Enable RDS Service" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000101
- Vuln IDs
-
- V-237171
- V-62415
- Rule IDs
-
- SV-237171r641608_rule
- SV-76905
Checks: C-40390r641606_chk
Ask the administrator if LiveCycle Data Services ES are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable Remote Adobe LiveCycle Data Management access" is checked, this is a finding.
Fix: F-40353r641607_fix
Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck "Enable Remote Adobe Live Cycle Data Management access" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000102
- Vuln IDs
-
- V-237172
- V-62417
- Rule IDs
-
- SV-237172r641611_rule
- SV-76907
Checks: C-40391r641609_chk
Ask the administrator if WebSocket services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "WebSocket" page under the "Server Settings" menu. If "Enable WebSocket Service" is checked, this is a finding.
Fix: F-40354r641610_fix
Navigate to the "WebSocket" page under the "Server Settings" menu. Uncheck "Enable WebSocket Service" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000103
- Vuln IDs
-
- V-237173
- V-62419
- Rule IDs
-
- SV-237173r641614_rule
- SV-76909
Checks: C-40392r641612_chk
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Data Sources" page under the "Data & Services" menu. If the data sources cfartgallery, cfbookclub, cfcodeexplorer, or cfdocexamples exist, this is a finding.
Fix: F-40355r641613_fix
Remove the sample data sources by navigating to the "Data Sources" page under the "Data & Services" menu. Delete the data sources cfartgallery, cfbookclub, cfcodeexplorer, and cfdocexamples.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000104
- Vuln IDs
-
- V-237174
- V-62421
- Rule IDs
-
- SV-237174r641617_rule
- SV-76911
Checks: C-40393r641615_chk
Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. Within the server.xml file, locate the xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is defined during the install and can be changed from the default of 8500, so this parameter may be different if an alternate port was assigned. If the line exists and is not commented out (XML comments start with <!-- and end with -->, e.g., <!-- XML COMMENT -->), this is a finding.
Fix: F-40356r641616_fix
Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. After making a backup of this file, edit the file and locate the following xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is setup at install and can be changed, so this parameter may be different in this line. This line can be deleted or using XML syntax can be commented out of the configuration. XML comment syntax starts with <!-- and ends with -->, e.g., <!-- XML COMMENT -->.
- RMF Control
- CM-7
- Severity
- High
- CCI
- CCI-000381
- Version
- CF11-03-000105
- Vuln IDs
-
- V-237175
- V-62423
- Rule IDs
-
- SV-237175r641620_rule
- SV-76913
Checks: C-40394r641618_chk
Within the Administrator Console, navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. If "Allow Remote Inspection" is checked, this is a finding.
Fix: F-40357r641619_fix
Navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. Uncheck "Allow Remote Inspection" and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000106
- Vuln IDs
-
- V-237176
- V-62425
- Rule IDs
-
- SV-237176r641623_rule
- SV-76915
Checks: C-40395r641621_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." is unchecked, this is a finding.
Fix: F-40358r641622_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." and select the "Submit Changes" button.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000382
- Version
- CF11-03-000107
- Vuln IDs
-
- V-237177
- V-62427
- Rule IDs
-
- SV-237177r641626_rule
- SV-76917
Checks: C-40396r641624_chk
Access the Administrator Console from a web browser. If a port is part of the URL, verify that the port used is an approved port. Within the Administrator Console, navigate to each page under the "Data & Services" menu viewing the port settings for each connection and service. If the Administrator Console or any "Data & Services" setting is not using an approved port, this is a finding.
Fix: F-40359r641625_fix
Reconfigure the services or data connections that are using an unapproved port to use an approved port.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001813
- Version
- CF11-03-000108
- Vuln IDs
-
- V-237178
- V-62429
- Rule IDs
-
- SV-237178r641629_rule
- SV-76919
Checks: C-40397r641627_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Check configuration files for changes every" is checked, this is a finding.
Fix: F-40360r641628_fix
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Check configuration files for changes every" and select the "Submit Changes" button.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000110
- Vuln IDs
-
- V-237179
- V-62431
- Rule IDs
-
- SV-237179r641632_rule
- SV-76921
Checks: C-40398r641630_chk
Locate the neo-security.xml file and locate the Root Administrator username. For ColdFusion running on Windows: 1. Open the neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> For ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Execute the following command to return the Root Administrator username: cat neo-security.xml | grep –i –oP ‘admin.userid.root’+”’><string>\K\w+” If the Root Administrator username is any upper-and lower-case mix of characters for the words admin or administrator (e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc.), this is a finding.
Fix: F-40361r641631_fix
Locate the neo-security.xml file and change to the directory where the file is located. Note: Make a backup of the file before making any modifications. For ColdFusion running on Windows: 1. Open the file neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 5. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 6. Save the file. 7. Restart ColdFusion to have the new username take effect. Within a terminal window, change to the bin directory under the ColdFusion installation directory and execute the command: coldfusion -restart -console ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Update the Root Administrator username by editing the neo-security.xml file. 3. Locate the <var name='admin.userid.root'> tag. The username is located in between the <string> and </string> tags that follow. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 4. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 5. Save the file. 6. Restart ColdFusion to have the new username take effect. ColdFusion can be restarted by changing to the bin directory under the ColdFusion installation directory and execute the command: coldfusion restart Validate that the new username is being used and that the system is operating properly. Once validated, the backup neo-security.xml file must be deleted.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000111
- Vuln IDs
-
- V-237180
- V-62433
- Rule IDs
-
- SV-237180r641635_rule
- SV-76923
Checks: C-40399r641633_chk
For ColdFusion running on Windows: 1. Run the snap-in services.msc. 2. Locate the ColdFusion section of services. 3. Right click on each ColdFusion service and select "Properties". 4. Select the "Log On" tab. If any service has "Local System account" selected, this is a finding. 5. View the groups for each user account that was used to run a ColdFusion service by running the snap-in compmgmt.msc. 6. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 7. Select the "Users" folder and the users will be listed in the right pane. 8. Right click a user that runs a ColdFusion service. 9. Select "Properties" on the menu. 10. Select the "Member Of" tab. If any groups are listed, this is a finding. 11. Click on the "Remote Desktop Services Profile" tab. If the "Deny this user permissions to log on to Remote Desktop Session Host server" is not checked, this is a finding. 12 Repeat steps 8 through 11 for each user that runs a ColdFusion service. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Execute the command: grep -i -m 1 runtime_user coldfusion_11 4. The user being used to execute ColdFusion will be listed. 5. View the user within the /etc/passwd file. 6. Make note of the user id and group id. For example, if the line in the passwd file is cfuser:x:500:501:ColdFusion:/home/cfuser:/sbin/nologin, the user id is 500 and the group id is 501. If the user id or the group id is set to 0 (zero), this is a finding.
Fix: F-40362r641634_fix
For ColdFusion running on Windows: 1. Create a user for the ColdFusion services by running the snap-in compmgmt.msc. 2. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 3. Select the "Users" folder. 4. Right click in the right pane and select "New User". 5. Enter a username and password for the user. Follow any organization specific policies in place and Windows STIGs for password complexity, usernames, etc. 6. Select the "Create" button to create the user. 7. Right click on the new user and select the "Properties" menu item. 8. Select the "Member Of" tab. 9. Remove all groups. 10. Select the "Remote Desktop Services Profile" tab. 11. Check the "Deny this user permissions to log on to Remote Desktop Session Host server" checkbox. 12. Select the "Apply" button. 13. Run the snap-in services.msc. 14. Locate the ColdFusion services. 15. Right click on a ColdFusion service and select "Properties". 16. Select the "Log On" tab. 17. Click on the "This account:" radio button. 18. Enter the username and password for the user account that was just created. 19. Select "Ok" to save the changes. 20. Repeat steps 15 through 19 for each ColdFusion service. ColdFusion running on Linux: 1. Create a group for the user account that will run the ColdFusion service by executing the command groupadd. For example, if the group being created is webusers, the command would be: groupadd webusers 2. Create the user account for the service by executing the command adduser. For example, if the user being created is cfuser with the group webusers, the command would be: adduser -g webusers -s /sbin/nologin -M -c ColdFusion cfuser 3. Assign a password to the account that follows any organization password policies in place and the OS STIG for password complexity. The password is assigned by executing the command: passwd cfuser 4. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 5. Change to the directory where the file is located. 6. Edit the coldfusion_11 file. 7. Locate the text RUNTIME_USER= within coldfusion_11 8. Update the user account being used to run the ColdFusion service.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000112
- Vuln IDs
-
- V-237181
- V-62435
- Rule IDs
-
- SV-237181r641638_rule
- SV-76925
Checks: C-40400r641636_chk
Review the users within the "User Manager" page under the "Security" menu. If users exist that are not approved by the ISSM, this is a finding.
Fix: F-40363r641637_fix
Navigate to the "User Manager" page under the "Security" menu. Modify the list of users to only contain those approved by the ISSM.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000113
- Vuln IDs
-
- V-237182
- V-62437
- Rule IDs
-
- SV-237182r641641_rule
- SV-76927
Checks: C-40401r641639_chk
For ColdFusion running on Windows, this finding is not applicable. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Locate the umask setting. It should be located near the top of the file, but below the #description comment. If the umask is not set to 007 or more restrictive, this is a finding.
Fix: F-40364r641640_fix
For ColdFusion running on Windows, this finding is not applicable. 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Add the umask setting near the top of the file, but below the #description comment. A sample umask setting looks like: umask 007
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000114
- Vuln IDs
-
- V-237183
- V-62439
- Rule IDs
-
- SV-237183r641644_rule
- SV-76929
Checks: C-40402r641642_chk
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If "Enable ColdFusion Sandbox Security" is unchecked, this is a finding.
Fix: F-40365r641643_fix
Navigate to the "Sandbox Security" page under the "Security" menu. Check "Enable ColdFusion Sandbox Security" and select the "Submit Changes" button.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000115
- Vuln IDs
-
- V-237184
- V-62441
- Rule IDs
-
- SV-237184r641647_rule
- SV-76931
Checks: C-40403r641645_chk
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. Sandboxes should be setup for the Administrator Console and any other hosted applications. The Administrator Console must have its own sandbox separate from the other hosted applications. If there are no sandboxes implemented for the Administrator Console and the other hosted applications, this is a finding.
Fix: F-40366r641646_fix
Navigate to the "Sandbox Security" page under the "Security" menu. Create sandboxes for the applications to operate within and select the "Submit Changes" button.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- CF11-03-000116
- Vuln IDs
-
- V-237185
- V-62443
- Rule IDs
-
- SV-237185r641650_rule
- SV-76933
Checks: C-40404r641648_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Default ScriptSrc Directory" is set to /CFIDE/scripts/", this is a finding.
Fix: F-40367r641649_fix
Navigate to the "Settings" page under the "Server Settings" menu. Enter the new location for the ScriptSrc Directory.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- CF11-03-000117
- Vuln IDs
-
- V-237186
- V-62445
- Rule IDs
-
- SV-237186r766577_rule
- SV-76935
Checks: C-40405r766575_chk
Open the ColdFusion Administrator Console. Check the version of ColdFusion. If the system is running ColdFusion 11, this is a finding.
Fix: F-40368r766576_fix
Upgrade ColdFusion to a supported version or uninstall the application. All upgrade or uninstall actions should be executed in accordance with an approved application management plan.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000118
- Vuln IDs
-
- V-237187
- V-62447
- Rule IDs
-
- SV-237187r641656_rule
- SV-76937
Checks: C-40406r641654_chk
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "ColdFusion Collections" page under the "Data & Services" menu. If the bookclub collection exists, this is a finding.
Fix: F-40369r641655_fix
Remove the sample collections by navigating to the "ColdFusion Collections" page under the "Data & Services" menu. Delete the bookclub collection.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- CF11-03-000119
- Vuln IDs
-
- V-237188
- V-62449
- Rule IDs
-
- SV-237188r641659_rule
- SV-76939
Checks: C-40407r641657_chk
Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Gateway Instances" page under the "Event Gateways" menu. If the Gateway Instance SMS Menu App. exists, this is a finding.
Fix: F-40370r641658_fix
Remove the sample gateway instances by navigating to the "Gateway Instances" page under the "Event Gateways" menu. Delete the Gateway Instance SMS Menu App.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000770
- Version
- CF11-04-000128
- Vuln IDs
-
- V-237189
- V-62451
- Rule IDs
-
- SV-237189r641662_rule
- SV-76941
Checks: C-40408r641660_chk
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. If there are no defined users, this is a finding.
Fix: F-40371r641661_fix
Navigate to the "User Manager" page under the "Security" menu. Create users that need access to the Administrator Console providing only the roles necessary to perform each job function.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-001941
- Version
- CF11-04-000129
- Vuln IDs
-
- V-237190
- V-62453
- Rule IDs
-
- SV-237190r641665_rule
- SV-76943
Checks: C-40409r641663_chk
Determine if web services are published using the SOAP protocol to access sensitive data. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Determine if the ws-security suite is in place to provide secure authentication to the sensitive data by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are published using the SOAP protocol to access sensitive data and the ws-security suite is not used to secure the access, this is a finding.
Fix: F-40372r641664_fix
If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Install the ws-security suite to secure access to sensitive data.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000197
- Version
- CF11-04-000133
- Vuln IDs
-
- V-237191
- V-62455
- Rule IDs
-
- SV-237191r641668_rule
- SV-76945
Checks: C-40410r641666_chk
Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. Ask the administrator if Flex is being used and if user credentials are being used for authentication. If user credentials are being used for Flex authentication to ColdFusion and "Enable RMI over SSL for Data Management" is not checked, this is a finding.
Fix: F-40373r641667_fix
Navigate to the "Flex Integration" page under the "Data & Services" menu. Check "Enable RMI over SSL for Data Management" and select the "Submit Changes" button.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000197
- Version
- CF11-04-000134
- Vuln IDs
-
- V-237192
- V-62457
- Rule IDs
-
- SV-237192r641671_rule
- SV-76947
Checks: C-40411r641669_chk
Access the Administrator Console through a web browser. Look for indications that the communication is an https session through the prefix of https on the url and/or the lock icon, depending on the browser in use. If https does not appear to be in use, this is a finding.
Fix: F-40374r641670_fix
Review the documentation for the web server where the Administrator Console is being hosted and setup https encryption to protect passwords during the authentication process.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000197
- Version
- CF11-04-000135
- Vuln IDs
-
- V-237193
- V-62459
- Rule IDs
-
- SV-237193r641674_rule
- SV-76949
Checks: C-40412r641672_chk
Within the Administrator Console, navigate to the "Mail" page under the "Server Settings" menu. If a user name and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.
Fix: F-40375r641673_fix
Navigate to the "Mail" page under the "Server Settings" menu. Enable SSL/TLS by checking "Enable SSL socket connections to mail server" and/or "Enable TLS connection to mail server" options and select the "Submit Changes" button.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000186
- Version
- CF11-04-000138
- Vuln IDs
-
- V-237194
- V-62461
- Rule IDs
-
- SV-237194r641677_rule
- SV-76951
Checks: C-40413r641675_chk
Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable RMI over SSL for Data Management" is checked, make note of the path and filename of the keystore used. Navigate to the "WebSocket" page under the "Server Settings" menu. If "SSL Port" is checked, make note of the keystore path and filename. Review the permissions on the files designated in the keystore locations specified. ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion on the keystore file. No other users should have permissions. If permissions are granted to other users or roles, this is a finding. If ColdFusion is installed on Linux, the permissions must be 750 or more restrictive with the owner set to the user running the ColdFusion service and a group of root. If the permissions are more permissive, this is a finding.
Fix: F-40376r641676_fix
Locate the keystore file(s). The location can be found in the Administrator Console within the "Flex Integration" page under the "Data & Services" menu and within the "WebSocket" page under the "Server Settings" menu. The keystore(s) should have the following permissions: ColdFusion running on Windows: 1. Right click on the keystore and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click 'Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly and chown to set the owner and group. For example, if the keystore is named /opt/cf11/jre/lib/security/cacerts and you want to set the owner to cfuser, the commands would be: chown cfuser:root /opt/cf11/jre/lib/security/cacerts chmod 750 /opt/cf11/jre/lib/security/cacerts
- RMF Control
- SC-2
- Severity
- Medium
- CCI
- CCI-001082
- Version
- CF11-05-000161
- Vuln IDs
-
- V-237195
- V-62463
- Rule IDs
-
- SV-237195r641680_rule
- SV-76953
Checks: C-40414r641678_chk
Access the Administrator Console through a browser making note of the IP address that is used to access the console. Review the site's network diagram to validate that the IP used is on a management network and is separate from the public network. If the Administrator Console is not part of a management network, this is a finding.
Fix: F-40377r641679_fix
Host the ColdFusion Administrator Console on a management network.
- RMF Control
- SC-2
- Severity
- Medium
- CCI
- CCI-001082
- Version
- CF11-05-000162
- Vuln IDs
-
- V-237196
- V-62465
- Rule IDs
-
- SV-237196r641683_rule
- SV-76955
Checks: C-40415r641681_chk
Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If the Administrator Console is not hosted within a sandbox, this is a finding.
Fix: F-40378r641682_fix
Navigate to the "Sandbox Security" page under the "Security" menu. Create sandbox for the Administrator Console to operate within and select the "Submit Changes" button.
- RMF Control
- SC-2
- Severity
- Medium
- CCI
- CCI-001082
- Version
- CF11-05-000163
- Vuln IDs
-
- V-237197
- V-62467
- Rule IDs
-
- SV-237197r641686_rule
- SV-76957
Checks: C-40416r641684_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Disable creation of unnamed applications" is unchecked, this is a finding.
Fix: F-40379r641685_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable creation of unnamed applications" and select the "Submit Changes" button.
- RMF Control
- SC-2
- Severity
- Medium
- CCI
- CCI-001082
- Version
- CF11-05-000164
- Vuln IDs
-
- V-237198
- V-62469
- Rule IDs
-
- SV-237198r641689_rule
- SV-76959
Checks: C-40417r641687_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allow adding application variables to Servlet Context" is checked, this is a finding.
Fix: F-40380r641688_fix
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Allow adding application variables to Servlet Context" and select the "Submit Changes" button.
- RMF Control
- SC-23
- Severity
- Medium
- CCI
- CCI-001664
- Version
- CF11-05-000167
- Vuln IDs
-
- V-237199
- V-62471
- Rule IDs
-
- SV-237199r641692_rule
- SV-76961
Checks: C-40418r641690_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Use UUID for cftoken" is not checked, this is a finding.
Fix: F-40381r641691_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Use UUID for cftoken" and select the "Submit Changes" button.
- RMF Control
- SC-23
- Severity
- Medium
- CCI
- CCI-001664
- Version
- CF11-05-000168
- Vuln IDs
-
- V-237200
- V-62473
- Rule IDs
-
- SV-237200r641695_rule
- SV-76963
Checks: C-40419r641693_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Use J2EE session variables" is not checked, this is a finding.
Fix: F-40382r641694_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Use J2EE session variables" and select the "Submit Changes" button.
- RMF Control
- SC-23
- Severity
- Medium
- CCI
- CCI-001664
- Version
- CF11-05-000169
- Vuln IDs
-
- V-237201
- V-62475
- Rule IDs
-
- SV-237201r641698_rule
- SV-76965
Checks: C-40420r641696_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Cookie Timeout" is not set to -1, this is a finding.
Fix: F-40383r641697_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the parameter "Cookie Timeout" to -1 and select the "Submit Changes" button.
- RMF Control
- SC-24
- Severity
- Medium
- CCI
- CCI-001190
- Version
- CF11-05-000173
- Vuln IDs
-
- V-237202
- V-62477
- Rule IDs
-
- SV-237202r641701_rule
- SV-76967
Checks: C-40421r641699_chk
This requirement is dependent upon system mission criticality. If the system is not mission critical and does not require redundancy, this finding is not applicable. Within the Administrator Console, navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Verify that there are configured clusters with more than 1 server in each cluster. If there are no clusters defined or there is only one server in the cluster, this is a finding.
Fix: F-40384r641700_fix
Navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Create a cluster by defining a name and adding it to the configured clusters. Edit the cluster to add available servers to the cluster and submit the changes to the cluster.
- RMF Control
- SC-23
- Severity
- Medium
- CCI
- CCI-002470
- Version
- CF11-05-000178
- Vuln IDs
-
- V-237203
- V-62479
- Rule IDs
-
- SV-237203r641704_rule
- SV-76969
Checks: C-40422r641702_chk
Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. To view the certificates stored within this file, execute the java command keytool -list -v -keystore ./cacerts and verify that the Certificate Authority (CA) for each certificate is DoD-approved. If any certificates have a CA that is not DoD-approved, this is a finding.
Fix: F-40385r641703_fix
Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. Remove the certificates that have a CA that is non-DoD approved and import DoD CA-approved certificates.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000181
- Vuln IDs
-
- V-237204
- V-62481
- Rule IDs
-
- SV-237204r641707_rule
- SV-76971
Checks: C-40423r641705_chk
If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Validate that two or more servers have been defined and that the servers are on different hosts. If there are fewer than two servers available or the servers are on the same host, this is a finding. Navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. If there are no clusters defined or any cluster has fewer than two servers in the cluster, this is a finding.
Fix: F-40386r641706_fix
If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Define two or more servers to be part of each cluster. Once the servers are defined for the cluster(s), navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. Define clusters for your mission critical ColdFusion installation. Each defined cluster must contain two or more servers.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000182
- Vuln IDs
-
- V-237205
- V-62483
- Rule IDs
-
- SV-237205r641710_rule
- SV-76973
Checks: C-40424r641708_chk
Within the Administrator Console, navigate to the "Client Variables" page under the "Server Settings" menu. If the default storage mechanism for client sessions is set to "Registry", this is a finding.
Fix: F-40387r641709_fix
Navigate to the "Client Variables" page under the "Server Settings" menu. Set the default storage mechanism for client sessions to any available mechanism other than the registry and select the "Apply" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000183
- Vuln IDs
-
- V-237206
- V-62485
- Rule IDs
-
- SV-237206r641713_rule
- SV-76975
Checks: C-40425r641711_chk
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if flash remoting is being used (Note: The Server Monitor feature in ColdFusion Enterprise makes use of flash remoting.). If flash remoting is being used, this finding is not applicable. If "Maximum number of simultaneous Flash Remoting requests" is not set to 1, this is a finding.
Fix: F-40388r641712_fix
If flash remoting is being used, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Flash Remoting requests" to 1 and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- High
- CCI
- CCI-002385
- Version
- CF11-05-000184
- Vuln IDs
-
- V-237207
- V-62487
- Rule IDs
-
- SV-237207r641716_rule
- SV-76977
Checks: C-40426r641714_chk
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. If any of the data sources have CREATE, GRANT, DROP, REVOKE or ALTER checked, this is a finding.
Fix: F-40389r641715_fix
If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. Uncheck the allow SQL of CREATE, GRANT, DROP, REVOKE and ALTER and select the "Submit" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000185
- Vuln IDs
-
- V-237208
- V-62489
- Rule IDs
-
- SV-237208r641719_rule
- SV-76979
Checks: C-40427r641717_chk
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. Check to see if the data source has the capability to specify a query timeout. If available, this parameter must not be 0 (No Timeout). If a data source does not have this setting, then this is not a finding for this data source. If any of the data sources have a query timeout set to 0, this is a finding.
Fix: F-40390r641718_fix
If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. If the data source has a query timeout parameter, set the timeout parameter to a value greater than 0 and select the "Submit" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000186
- Vuln IDs
-
- V-237209
- V-62491
- Rule IDs
-
- SV-237209r641722_rule
- SV-76981
Checks: C-40428r641720_chk
Determine if web services are being published for the hosted applications. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If Web Services are being published for hosted applications, this find is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If Web Services are not being published for hosted applications and the "Maximum number of simultaneous Web Service requests" is not set to 1, this is a finding.
Fix: F-40391r641721_fix
If Web Services are being published for hosted applications, this find is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Web Service requests" to 1 and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000187
- Vuln IDs
-
- V-237210
- V-62493
- Rule IDs
-
- SV-237210r641725_rule
- SV-76983
Checks: C-40429r641723_chk
Determine if CFC functions are being called directly from http/https for any hosted application. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation or ColdFusion baseline documentation. If CFC requests are being used by hosted applications, this finding is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If the CFC requests are not being used by hosted applications and "Maximum number of simultaneous CFC function requests" is not set to 1, this is a finding.
Fix: F-40392r641724_fix
If CFC requests are being used by hosted applications, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous CFC function requests" to 1 and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000188
- Vuln IDs
-
- V-237211
- V-62495
- Rule IDs
-
- SV-237211r641728_rule
- SV-76985
Checks: C-40430r641726_chk
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Maximum number of simultaneous Report threads" is not set to 1, this is a finding.
Fix: F-40393r641727_fix
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Report threads" to 1 and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000189
- Vuln IDs
-
- V-237212
- V-62497
- Rule IDs
-
- SV-237212r641731_rule
- SV-76987
Checks: C-40431r641729_chk
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if threading, calls to CFTHREAD, is being used by any of the hosted application. If threading is being used, this finding is not applicable. If threading is not being used and "Maximum number of threads available for CFTHREAD" is not set to 1, this is a finding.
Fix: F-40394r641730_fix
If threading is being used, this finding is not applicable. Navigate to the "Request Tuning page under the Server Settings" menu. Set "Maximum number of threads available for CFTHREAD" to 1 and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000190
- Vuln IDs
-
- V-237213
- V-62499
- Rule IDs
-
- SV-237213r641734_rule
- SV-76989
Checks: C-40432r641732_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Review system documentation. Determine if the "Timeout Requests after" setting has been tuned to account for application and system performance. If "Timeout Requests after seconds" is not set to "5" or is not set in accordance with the documented tuning parameters, this is a finding.
Fix: F-40395r641733_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Timeout Requests after seconds" and set the value to "5" or to the documented tuned value and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000191
- Vuln IDs
-
- V-237214
- V-62501
- Rule IDs
-
- SV-237214r641737_rule
- SV-76991
Checks: C-40433r641735_chk
Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" menu. If there are no data sources defined, this finding is not applicable. For each Data Source, view the "Login Timeout (sec)" setting within the Advanced Settings for the data source by editing the data source and then pressing the "Show Advanced Settings" button. If there are any data sources with a "Login Timeout (sec)" set higher than 5, this is a finding.
Fix: F-40396r641736_fix
Navigate to the "Data Sources" page under the "Data & Services" menu. Edit each data source and set the "Login Timeout (sec)" to 5 or less within the advanced settings for the data source.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000192
- Vuln IDs
-
- V-237215
- V-62503
- Rule IDs
-
- SV-237215r641740_rule
- SV-76993
Checks: C-40434r641738_chk
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Timeout requests waiting in queue after" setting is set higher than 5, this is a finding.
Fix: F-40397r641739_fix
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Timeout requests waiting in queue after" to 5 or less and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Low
- CCI
- CCI-002385
- Version
- CF11-05-000193
- Vuln IDs
-
- V-237216
- V-62505
- Rule IDs
-
- SV-237216r641743_rule
- SV-76995
Checks: C-40435r641741_chk
Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Validate that the "Request Queue Timeout Page" setting is set to a valid and custom page. If "Request Queue Timeout Page" is blank or is set to /CFIDE/administrator/templates/request_timeout_error.cfm, this is a finding. If a page is specified, validate that the file exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Request Queue Timeout Page" is set to /CFIDE/administrator/templates/timeout_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/timeout_error.cfm If the "Request Queue Timeout Page" setting is not set to a valid page, this is a finding.
Fix: F-40398r641742_fix
Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Request Queue Timeout Page" to a custom and valid error page and select the "Submit Changes" button.
- RMF Control
- SC-5
- Severity
- Medium
- CCI
- CCI-002385
- Version
- CF11-05-000194
- Vuln IDs
-
- V-237217
- V-62507
- Rule IDs
-
- SV-237217r641746_rule
- SV-76997
Checks: C-40436r641744_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Review system documentation. Determine if the "Maximum number of POST request parameters" setting has been tuned to account for application and system performance. If "Maximum number of POST request parameters" is not set to "50" or is not set in accordance with documented tuning parameters, this is a finding.
Fix: F-40399r641745_fix
Navigate to the "Settings" page under the "Server Settings" menu. Set "Maximum number of POST request parameters" to "50" or to the value specified in the documented tuning parameters and select the "Submit Changes" button.
- RMF Control
- SC-8
- Severity
- Medium
- CCI
- CCI-002418
- Version
- CF11-05-000195
- Vuln IDs
-
- V-237218
- V-62509
- Rule IDs
-
- SV-237218r641749_rule
- SV-76999
Checks: C-40437r641747_chk
Review the setting "JVM arguments" within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. The parameter -Dhttps.protocols is used to set the TLS versions that the JVM can use. Valid values for this setting must be TLS versions 1.0 or higher. An example settings to use TLS versions 1.2, 1.1 and 1.0 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 and an example to only use TLS version 1.2 is -Dhttps.protocols=TLSv1.2 If the "JVM arguments" setting does not contain the parameter -Dhttps.protocols or if the parameter -Dhttps.protocols contains any SSL versions, this is a finding.
Fix: F-40400r641748_fix
Navigate to the "JVM arguments" setting within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. Add the parameter -Dhttps.protocols and set the parameter to the TLS versions to be used. A sample setting to use TLSv1.2, TLSv1.1 and TLSv1 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1. SSL versions must not be added to this parameter. Once the parameter is added to the JVM arguments, select the "Submit Changes" button to save the changes and restart the ColdFusion application server to have the changes take effect.
- RMF Control
- SC-8
- Severity
- Medium
- CCI
- CCI-002418
- Version
- CF11-05-000196
- Vuln IDs
-
- V-237219
- V-62511
- Rule IDs
-
- SV-237219r641752_rule
- SV-77001
Checks: C-40438r641750_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Secure Cookie" is not checked, this is a finding.
Fix: F-40401r641751_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Secure Cookie" and select the "Submit Changes" button.
- RMF Control
- SC-8
- Severity
- Medium
- CCI
- CCI-002421
- Version
- CF11-05-000197
- Vuln IDs
-
- V-237220
- V-62513
- Rule IDs
-
- SV-237220r641755_rule
- SV-77003
Checks: C-40439r641753_chk
Within the Administrator Console, navigate to the "Java and JVM" page under the "Server Settings" menu. If the JVM argument-Dcoldfusion.enablefipscrypto=true cannot be found or -Dcoldfusion.enablefipscrypto is set to false, this is a finding.
Fix: F-40402r641754_fix
Navigate to the "Java and JVM" page under the "Server Settings" menu. Locate the JVM argument coldfusion.enablefipscrypto. If the argument cannot be found, add the argument as -Dcoldfusion.enablefipscrypto=true. If the parameter is defined but set to false, change the setting to true.
- RMF Control
- SC-8
- Severity
- Medium
- CCI
- CCI-002421
- Version
- CF11-05-000198
- Vuln IDs
-
- V-237221
- V-62515
- Rule IDs
-
- SV-237221r641758_rule
- SV-77005
Checks: C-40440r641756_chk
If the Administrator Console is used to perform patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console and review the setting "Site URL" within the "Settings" tab. If the URL is not prefixed by https://, this is a finding. If a manual process is used to retrieve patches, verify that a documented process is in place that includes using an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc. If there is not a documented process or the process does not include an encrypted method to download patches, this is a finding.
Fix: F-40403r641757_fix
If the Administrator Console is used for patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console. Locate the "Site URL" setting on the "Settings" tab. Update the URL used for updates to be prefixed with https:// so that the communication is encrypted and select the "Submit Changes" button. If a manual process is used to retrieve patches, document the process to retrieve the patches that uses an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc.
- RMF Control
- SC-8
- Severity
- Medium
- CCI
- CCI-002420
- Version
- CF11-05-000199
- Vuln IDs
-
- V-237222
- V-62517
- Rule IDs
-
- SV-237222r641761_rule
- SV-77007
Checks: C-40441r641759_chk
Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "HTTPOnly" is unchecked, this is a finding.
Fix: F-40404r641760_fix
Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "HTTPOnly" and select the "Submit Changes" button.
- RMF Control
- SC-8
- Severity
- High
- CCI
- CCI-002420
- Version
- CF11-05-000200
- Vuln IDs
-
- V-237223
- V-62519
- Rule IDs
-
- SV-237223r641764_rule
- SV-77009
Checks: C-40442r641762_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Prefix serialized JSON with" is unchecked, this is a finding.
Fix: F-40405r641763_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Prefix serialized JSON with" and select the "Submit Changes" button.
- RMF Control
- SC-13
- Severity
- Medium
- CCI
- CCI-002450
- Version
- CF11-05-000203
- Vuln IDs
-
- V-237224
- V-62521
- Rule IDs
-
- SV-237224r641767_rule
- SV-77011
Checks: C-40443r641765_chk
Interview the administrator to determine if ColdFusion is using certificates for PKI. If ColdFusion is not performing any PKI functions, this finding is not applicable. The CA certs are usually stored in a file called cacerts located in the directory $JAVA_HOME/jre/lib/security. If the file is not in this location, use a search command to locate the file or ask the administrator where the certificate store is located. Open a dos shell or terminal window and change to the location of the certificate store. To view the certificates within the certificate store, run the command (In this example, the keystore file is cacerts.): keytool -list -v -keystore cacerts Locate the "OU" field for each certificate within the keystore. The field should contain either DoD or CNSS as the Organizational Unit (OU). If the OU does not show that the certificates are DoD or CNSS supplied, this is a finding.
Fix: F-40406r641766_fix
Request a CNSS or DoD Class 3 or Class 4 certificate and add it to the keystore to be used for PKI communication.
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001312
- Version
- CF11-06-000216
- Vuln IDs
-
- V-237225
- V-62523
- Rule IDs
-
- SV-237225r641770_rule
- SV-77013
Checks: C-40444r641768_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Missing Template Handler" setting is not blank and that the template specified is a valid. If the "Missing Template Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Missing Template Handler" is set to /CFIDE/administrator/templates/missing_template_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/missing_template_error.cfm If the "Missing Template Handler" setting is not a valid file, this is a finding.
Fix: F-40407r641769_fix
Navigate to the "Settings" page under the "Server Settings" menu. Specify a valid handler for missing templates and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001312
- Version
- CF11-06-000217
- Vuln IDs
-
- V-237226
- V-62525
- Rule IDs
-
- SV-237226r641773_rule
- SV-77015
Checks: C-40445r641771_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Site-wide Error Handler" setting is not blank and that the template specified is valid. If the "Site-wide Error Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web server's document root is /opt/webserver/wwwroot and the "Site-wide Error Handler" is set to /CFIDE/administrator/templates/secure_profile_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/secure_profile_error.cfm If the "Site-wide Error Handler" setting is not a valid file, this is a finding.
Fix: F-40408r641772_fix
Navigate to the "Settings" page under the "Server Settings" menu. Specify a custom and valid site-wide error handler and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- High
- CCI
- CCI-001312
- Version
- CF11-06-000218
- Vuln IDs
-
- V-237227
- V-62527
- Rule IDs
-
- SV-237227r641776_rule
- SV-77017
Checks: C-40446r641774_chk
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Robust Exception Information" is checked, this is a finding.
Fix: F-40409r641775_fix
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Robust Exception Information" and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- High
- CCI
- CCI-001312
- Version
- CF11-06-000219
- Vuln IDs
-
- V-237228
- V-62529
- Rule IDs
-
- SV-237228r641779_rule
- SV-77019
Checks: C-40447r641777_chk
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable AJAX Debug Log Window" is checked, this is a finding.
Fix: F-40410r641778_fix
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable AJAX Debug Log Window" and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- High
- CCI
- CCI-001312
- Version
- CF11-06-000220
- Vuln IDs
-
- V-237229
- V-62531
- Rule IDs
-
- SV-237229r641782_rule
- SV-77021
Checks: C-40448r641780_chk
Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Request Debugging Output" is checked, this is a finding.
Fix: F-40411r641781_fix
Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Request Debugging Output" and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- High
- CCI
- CCI-001312
- Version
- CF11-06-000221
- Vuln IDs
-
- V-237230
- V-62533
- Rule IDs
-
- SV-237230r641785_rule
- SV-77023
Checks: C-40449r641783_chk
Within the Administrator Console, navigate to the "Debugger Settings" page under the "Debugging & Output Settings" menu. If "Allow Line Debugging" is checked, this is a finding.
Fix: F-40412r641784_fix
Navigate to the "Debugger Settings" page under the "Debugging & Output Settings" menu. Uncheck "Allow Line Debugging" and select the "Submit Changes" button.
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001314
- Version
- CF11-06-000222
- Vuln IDs
-
- V-237231
- V-62535
- Rule IDs
-
- SV-237231r641788_rule
- SV-77025
Checks: C-40450r641786_chk
Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. Review each defined user and ask the SA if the user should have access to read error messages. For each user that should not be able to read error messages, review the roles assigned to the user account. If any user has the Debugging and Logging>Logging role that should not be able to read error messages, this is a finding.
Fix: F-40413r641787_fix
Navigate to the "User Manager" page under the "Security" menu. Remove the "Debugging and Logging>Logging" role from each user that should not have access to read error messages.
- RMF Control
- SI-10
- Severity
- Medium
- CCI
- CCI-002754
- Version
- CF11-06-000223
- Vuln IDs
-
- V-237232
- V-62537
- Rule IDs
-
- SV-237232r641791_rule
- SV-77027
Checks: C-40451r641789_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Disable CFC Type check" is checked, this is a finding.
Fix: F-40414r641790_fix
Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Disable CFC Type check" and select the "Submit Changes" button.
- RMF Control
- SI-10
- Severity
- Medium
- CCI
- CCI-002754
- Version
- CF11-06-000224
- Vuln IDs
-
- V-237233
- V-62539
- Rule IDs
-
- SV-237233r641794_rule
- SV-77029
Checks: C-40452r641792_chk
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Enable Global Script Protection" is unchecked, this is a finding.
Fix: F-40415r641793_fix
Navigate to the "Settings" page under the "Server Settings" menu. Check "Enable Global Script Protection" and select the "Submit Changes" button.
- RMF Control
- SI-2
- Severity
- Medium
- CCI
- CCI-002617
- Version
- CF11-06-000225
- Vuln IDs
-
- V-237234
- V-62541
- Rule IDs
-
- SV-237234r641797_rule
- SV-77031
Checks: C-40453r641795_chk
Within the Administrator Console, navigate to the "Updates" page under the "Server Update" menu. Within the "Installed Updates" tab, locate the backup directory location for each update that is installed. On the server running the ColdFusion server, verify that the backup directories do not exist for any of the updates. If all updates have been tested/verified and any of the backup directories exist, this is a finding. Note: Do not remove the backup directory for an update until the update has been tested and verified that the ColdFusion server is operating correctly.
Fix: F-40416r641796_fix
Navigate to the "Updates" page under the "Server Update" menu within the Administrator Console. Within the "Installed Updates" tab, locate the backup directory location for any updates installed. On the server running the ColdFusion server, remove all backup directories for any updates installed. Note: Do not remove the backup directory for an update until the update has been tested and verified that the ColdFusion server is operating correctly.
- RMF Control
- SI-2
- Severity
- Low
- CCI
- CCI-002605
- Version
- CF11-06-000226
- Vuln IDs
-
- V-237235
- V-62543
- Rule IDs
-
- SV-237235r641800_rule
- SV-77033
Checks: C-40454r641798_chk
Determine if the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository. This may be determined by interviewing the administrator or by reviewing ColdFusion baseline documentation. If the ColdFusion server has access to a patch repository, the server must check for updates. To verify that the server is checking for updates, within the Administrator Console, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and verify that the "Automatically Check for Updates" is checked. If the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository and "Automatically Check for Updates" is not checked, this is a finding. If the ColdFusion server does not have access to Adobe or an internally maintained patch repository, then a manual process must be documented to check for updates. The documented process must include the location and how often to check for updates. If the process is not documented or the documented process does not include location and frequency, this is a finding.
Fix: F-40417r641799_fix
If the ColdFusion server has access to a patch repository, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and check the "Automatically Check for Updates" setting and select the "Submit Changes" button. If the ColdFusion server does not have access to a patch repository, document the process to check for updates. The documented process must include location and how often.
- RMF Control
- SI-2
- Severity
- Low
- CCI
- CCI-002605
- Version
- CF11-06-000227
- Vuln IDs
-
- V-237236
- V-62545
- Rule IDs
-
- SV-237236r641803_rule
- SV-77035
Checks: C-40455r641801_chk
Determine if the ColdFusion server has access to either the Adobe patch repository or an internally maintained patch repository. This may be determined by interviewing the administrator or by reviewing ColdFusion baseline documentation. If the ColdFusion server has access to a patch repository, the server must notify administrators when updates are available. To verify that the server is notifying administrators, within the Administrator Console, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and verify that the "Check for updates every" is checked, that a positive value is entered for the "days" value and that at least one email address is entered for notification. If "Check for updates every" is not checked, the "days" value is empty or less than 1, or the "If updates are available, send email notification to" parameter is empty, this is a finding. If the ColdFusion server does not have access to a patch repository, then a documented notification process must be in place along with the administrator's enrollment in the Adobe automated patch notification service. To validate enrollment, a verification email or patch notification email can be used. If the administrators are not enrolled in the Adobe patch notification service or the process is not documented, this is a finding.
Fix: F-40418r641802_fix
If the ColdFusion server has access to a patch repository, navigate to the "Updates" page under the "Server Updates" menu. Select the "Settings" tab and check the "Check for updates every" setting, enter a value greater than 0 for the "days" setting, and enter email addresses for notification. Select the "Submit Changes" button to save the new settings. If the ColdFusion server does not have access to a patch repository, document the process to enroll into the Adobe patch notification service and enroll all administrators in the notification service.