Adobe ColdFusion 11 Security Technical Implementation Guide

Version

CF11-03-000096

Vuln IDs

V-62405

Rule IDs

SV-76895r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. One area of concern is the file types that can be included in cfm and cfml files by programmers. To control what types of technologies are used in the development of hosted applications, a default whitelist can be created and approved by the ISSO. This list includes only those file extensions that are used by the hosted applications. By default, cfm and cfml are included and do not have to be specified. The list must not contain the wildcard string "*.*".

Checks: C-63209r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allowed file extensions for CFInclude tag" is empty, this is not a finding. If the "Allowed file extensions for CFInclude tag" contains the wildcard string "*.*" or if the list of file extensions is not the list approved by the ISSO, this is a finding.

Fix: F-68325r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Enter the list of approved file extensions in the "Allowed file extensions for CFInclude tag" field and select the "Submit Changes" button. A blank list will only allow cfm and cfml files to be included and fulfills this requirement.

c

ColdFusion must disable Flash Remoting support.

CM-7 - High - CCI-000381 - V-62407 - SV-76897r1_rule

RMF Control

CM-7

Severity

H

CCI

Version

CF11-03-000097

Vuln IDs

V-62407

Rule IDs

SV-76897r1_rule

Application servers provide a myriad of differing processes, features and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Flash Remoting allows a Flash client to connect to the ColdFusion server and invoke ColdFusion Components (CFCs). Allowing this service to be enabled when not needed by hosted applications and when ColdFusion server monitoring is not being used provides an avenue for an attacker to gain access to the server.

Checks: C-63211r1_chk

Ask the administrator if ColdFusion server monitoring is being used or if flex remoting is being used by any hosted applications. If ColdFusion server monitoring is being used or hosted applications are using flash remoting, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If the "Enable Flash Remoting" option is checked, this is a finding.

Fix: F-68327r1_fix

Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck the "Enable Flash Remoting" option and select the "Submit Changes" button.

b

ColdFusion must disable the In-Memory File System.

CM-7 - Medium - CCI-000381 - V-62409 - SV-76899r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000098

Vuln IDs

V-62409

Rule IDs

SV-76899r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. ColdFusion offers an in-memory file system. This feature can be used to have dynamic code execute quickly which in turns enables an application to execute quicker. This feature can also be used by an attacker to execute dynamic code that is erased and unrecoverable on system reboot making forensic analysis impossible.

Checks: C-63213r1_chk

Ask the administrator if the in-memory file system is being used by any hosted applications. If hosted applications are using the in-memory file system, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Enable In-Memory File System" is checked, this is a finding.

Fix: F-68329r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Enable In-Memory File System" and select the "Submit Changes" button.

b

ColdFusion must have Event Gateway Services disabled.

CM-7 - Medium - CCI-000381 - V-62411 - SV-76901r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000099

Vuln IDs

V-62411

Rule IDs

SV-76901r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Event Gateway Services are used to pass events from external sources to ColdFusion components that are specified. Since this gateway is accepting events from external sources, a listener must be present. When enabled, along with the listener, memory, queues, and processes are available for gateway processes. These resources can be used by an attacker and should be disabled if the feature is not being used for hosted applications.

Checks: C-63215r1_chk

Ask the administrator if Event Gateway services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Settings" page under the "Event Gateways" menu. If "Enable ColdFusion Event Gateway Services" is checked, this is a finding.

Fix: F-68331r1_fix

Navigate to the "Settings" page under the "Event Gateway" menu. Uncheck "Enable ColdFusion Event Gateway Services" and select the "Submit Changes" button.

c

ColdFusion must have Remote Development Services (RDS) disabled.

CM-7 - High - CCI-000381 - V-62413 - SV-76903r1_rule

RMF Control

CM-7

Severity

H

CCI

Version

CF11-03-000100

Vuln IDs

V-62413

Rule IDs

SV-76903r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Development Services (RDS) is used in a development environment to allow authenticated users access to the server using special features within code editors like Dreamweaver, HomeSite+, ColdFusion Studio, and Eclipse to obtain information from the server. For example, developers can determine what data sources exist, query them, build code based on them, and more. RDS also enables access from within the editors to files on the server (even remotely) over HTTP, as an alternative to FTP. This feature is not meant for production environments.

Checks: C-63217r1_chk

Within the Administrator Console, navigate to the "RDS" page under the "Security" menu. If "Enable RDS Service" is checked, this is a finding.

Fix: F-68333r1_fix

Navigate to the "RDS" page under the "Security" menu. Uncheck "Enable RDS Service" and select the "Submit Changes" button.

b

ColdFusion must have Remote Adobe LiveCycle Data Management access disabled.

CM-7 - Medium - CCI-000381 - V-62415 - SV-76905r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000101

Vuln IDs

V-62415

Rule IDs

SV-76905r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Adobe LiveCycle Data Management access allows LiveCycle Data Services ES to connect to the ColdFusion server through RMI and use CFCs to read and update data that supports a Flex application. If this feature is not needed for hosted applications and is enabled, an attacker could use this feature to compromise the ColdFusion server.

Checks: C-63219r1_chk

Ask the administrator if LiveCycle Data Services ES are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable Remote Adobe LiveCycle Data Management access" is checked, this is a finding.

Fix: F-68335r1_fix

Navigate to the "Flex Integration" page under the "Data & Services" menu. Uncheck "Enable Remote Adobe Live Cycle Data Management access" and select the "Submit Changes" button.

b

ColdFusion must have the WebSocket Service disabled.

CM-7 - Medium - CCI-000381 - V-62417 - SV-76907r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000102

Vuln IDs

V-62417

Rule IDs

SV-76907r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. The WebSocket Service is used to develop real-time applications for stock, charting, online gaming, social networking, dashboard for various purposes, and monitoring. The service uses http or https for communication either to a proxy server or to the built-in WebSocket Server. When the service is enabled and not used, resources are used but set idle. To allow the idle resources to be used for other services, if the WebSocket service is not be used by hosted applications, the service must be disabled.

Checks: C-63221r1_chk

Ask the administrator if WebSocket services are being used by any hosted applications. If hosted applications are using the service, this is not a finding. Within the Administrator Console, navigate to the "WebSocket" page under the "Server Settings" menu. If "Enable WebSocket Service" is checked, this is a finding.

Fix: F-68337r1_fix

Navigate to the "WebSocket" page under the "Server Settings" menu. Uncheck "Enable WebSocket Service" and select the "Submit Changes" button.

b

ColdFusion must have example data sources removed.

CM-7 - Medium - CCI-000381 - V-62419 - SV-76909r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000103

Vuln IDs

V-62419

Rule IDs

SV-76909r1_rule

ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.

Checks: C-63223r1_chk

Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Data Sources" page under the "Data & Services" menu. If the data sources cfartgallery, cfbookclub, cfcodeexplorer, or cfdocexamples exist, this is a finding.

Fix: F-68339r1_fix

Remove the sample data sources by navigating to the "Data Sources" page under the "Data & Services" menu. Delete the data sources cfartgallery, cfbookclub, cfcodeexplorer, and cfdocexamples.

b

The ColdFusion built-in TomCat Web Server must be disabled.

CM-7 - Medium - CCI-000381 - V-62421 - SV-76911r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000104

Vuln IDs

V-62421

Rule IDs

SV-76911r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. The built-in TomCat Web Server is used to host the Administrator Console and is used for initial setup. While the built-in server can be used to continually host the Administrator Console, this is not the best practice since the server is not guaranteed to be patched and upgraded, implementing TLS is not well documented, allowing for poor implementations, and commercial web servers offer better logging. To enable the Administrator Console to still operate and disable the built-in TomCat Web Server, the Administrator Console application must be moved to the web server (i.e., IIS, Apache, IBM HTTP Server, etc.) hosting the ColdFusion applications. Moving the Administrator Console to Apache and IIS is well documented in the Adobe ColdFusion Lockdown Guide.

Checks: C-63225r1_chk

Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. Within the server.xml file, locate the xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is defined during the install and can be changed from the default of 8500, so this parameter may be different if an alternate port was assigned. If the line exists and is not commented out (XML comments start with , e.g., ), this is a finding.

Fix: F-68341r2_fix

Locate the server.xml file for ColdFusion. This file can usually be located under the ColdFusion installation directory under the runtime/conf directory for Linux and runtime\conf for Windows. After making a backup of this file, edit the file and locate the following xml line: <Connector executor="tomcatThreadPool" maxThreads="50" port="8500" protocol="org.apache.coyote.http11.Http11Protocol" connectionTimeout="20000" redirectPort="8445" /> Note: port="8500" is the port the Administrator Console was hosted on. The port is setup at install and can be changed, so this parameter may be different in this line. This line can be deleted or using XML syntax can be commented out of the configuration. XML comment syntax starts with , e.g., .

c

ColdFusion must have Remote Inspection disabled.

CM-7 - High - CCI-000381 - V-62423 - SV-76913r1_rule

RMF Control

CM-7

Severity

H

CCI

Version

CF11-03-000105

Vuln IDs

V-62423

Rule IDs

SV-76913r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Remote Inspection is used to debug mobile applications and may contain sensitive information. This feature may be necessary as applications are built and tested, but once in a production environment, this setting is not necessary for daily operations and must be disabled.

Checks: C-63227r1_chk

Within the Administrator Console, navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. If "Allow Remote Inspection" is checked, this is a finding.

Fix: F-68343r1_fix

Navigate to the "Remote Inspection Settings" page under the "Debugging & Logging" menu. Uncheck "Allow Remote Inspection" and select the "Submit Changes" button.

b

ColdFusion must protect internal cookies from being updated by hosted applications.

CM-7 - Medium - CCI-000381 - V-62425 - SV-76915r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000106

Vuln IDs

V-62425

Rule IDs

SV-76915r1_rule

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system. Allowing developers to override global session cookie security settings is used to allow a hosted application to change the security posture of the application server. This feature may be necessary as applications are built and tested, but once in a production environment, this functionality is not necessary for daily operations and must be disabled.

Checks: C-63229r1_chk

Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." is unchecked, this is a finding.

Fix: F-68345r1_fix

Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." and select the "Submit Changes" button.

b

ColdFusion must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.

CM-7 - Medium - CCI-000382 - V-62427 - SV-76917r1_rule

RMF Control

CM-7

Severity

M

CCI

CCI-000382

Version

CF11-03-000107

Vuln IDs

V-62427

Rule IDs

SV-76917r1_rule

Some networking protocols may not meet organizational security requirements to protect data and components. ColdFusion may host a number of various features, such as the Administrator Console, data sources and various services. These features all run on TCPIP ports and protocols. This creates the potential that the vendor or ColdFusion administrator may choose to utilize port numbers or protocols that have been deemed unusable by the organization. When ports or protocols are used that are not secure or authorized by the organization, the ColdFusion feature must be reconfigured to use an authorized port and protocol. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.

Checks: C-63231r1_chk

Access the Administrator Console from a web browser. If a port is part of the URL, verify that the port used is an approved port. Within the Administrator Console, navigate to each page under the "Data & Services" menu viewing the port settings for each connection and service. If the Administrator Console or any "Data & Services" setting is not using an approved port, this is a finding.

Fix: F-68347r1_fix

Reconfigure the services or data connections that are using an unapproved port to use an approved port.

b

ColdFusion must disable auto reloading of configuration files on file changes.

CM-5 - Medium - CCI-001813 - V-62429 - SV-76919r1_rule

RMF Control

CM-5

Severity

M

CCI

CCI-001813

Version

CF11-03-000108

Vuln IDs

V-62429

Rule IDs

SV-76919r1_rule

When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software and/or application server configuration can potentially have significant effects on the overall security of the system. Allowing ColdFusion to watch for configuration file changes and reloading the new configuration gives an attacker an easy way to make modifications and have those changes become part of the executing production system quickly.

Checks: C-63233r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Check configuration files for changes every" is checked, this is a finding.

Fix: F-68349r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Check configuration files for changes every" and select the "Submit Changes" button.

b

The ColdFusion Root Administrator account must have a unique username.

CM-6 - Medium - CCI-000366 - V-62431 - SV-76921r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000110

Vuln IDs

V-62431

Rule IDs

SV-76921r1_rule

The ColdFusion Root Administrator account is an administrative account setup during the installation process. This account has privileges to view, update and delete data within the entire ColdFusion Administrator Console. The account is meant to be used to setup ColdFusion after installation, but should only be used in emergency situations once user accounts are created. The account is similar to the Administrator account in Windows or the root account in Linux. To help protect the account, the account username should not be admin or administrator. If setup with these usernames, an attacker already knows 50% of the information needed to gain access. A unique and not easily guessable username must be used to hinder the discovery of the account credentials.

Checks: C-63235r2_chk

Locate the neo-security.xml file and locate the Root Administrator username. For ColdFusion running on Windows: 1. Open the neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> For ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Execute the following command to return the Root Administrator username: cat neo-security.xml | grep –i –oP ‘admin.userid.root’+”’><string>\K\w+” If the Root Administrator username is any upper-and lower-case mix of characters for the words admin or administrator (e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc.), this is a finding.

Fix: F-68351r1_fix

Locate the neo-security.xml file and change to the directory where the file is located. Note: Make a backup of the file before making any modifications. For ColdFusion running on Windows: 1. Open the file neo-security.xml in notepad.exe (Hint: Turn Word Wrap on to make the file easier to read.). 2. Under the menu "Edit", select the "Find…" menu item. 3. In the "Find" window, put in the search text 'admin.userid.root'> including the single quotes. 4. The Root Administrator username follows this tag between the <string> and </string> tags. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 5. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 6. Save the file. 7. Restart ColdFusion to have the new username take effect. Within a terminal window, change to the bin directory under the ColdFusion installation directory and execute the command: coldfusion -restart -console ColdFusion running on Linux: 1. Change to the directory where the neo-security.xml file is located. 2. Update the Root Administrator username by editing the neo-security.xml file. 3. Locate the <var name='admin.userid.root'> tag. The username is located in between the <string> and </string> tags that follow. A sample entry may look like this if the Root Administrator username were Administrator: <var name='admin.userid.root'><string>Administrator</string> 4. Update the Root Administrator username. The new Root Administrator username must not be any upper and lower case mix of characters for the words admin or administrator, e.g., admin, Admin, ADMIN, Administrator, ADMINISTRATOR, etc. 5. Save the file. 6. Restart ColdFusion to have the new username take effect. ColdFusion can be restarted by changing to the bin directory under the ColdFusion installation directory and execute the command: coldfusion restart Validate that the new username is being used and that the system is operating properly. Once validated, the backup neo-security.xml file must be deleted.

b

ColdFusion must execute as a non-privileged user.

CM-6 - Medium - CCI-000366 - V-62433 - SV-76923r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000111

Vuln IDs

V-62433

Rule IDs

SV-76923r1_rule

Privileged user accounts are accounts that have access to all the system resources. These accounts are reserved for administrative users and applications that have a need for such unfettered access. Because ColdFusion does not need to run with access to all the system resources, the ColdFusion services must be setup to execute as unprivileged users. This protects server resources, OS hosted applications, and organization resources should the ColdFusion application server become compromised.

Checks: C-63237r1_chk

For ColdFusion running on Windows: 1. Run the snap-in services.msc. 2. Locate the ColdFusion section of services. 3. Right click on each ColdFusion service and select "Properties". 4. Select the "Log On" tab. If any service has "Local System account" selected, this is a finding. 5. View the groups for each user account that was used to run a ColdFusion service by running the snap-in compmgmt.msc. 6. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 7. Select the "Users" folder and the users will be listed in the right pane. 8. Right click a user that runs a ColdFusion service. 9. Select "Properties" on the menu. 10. Select the "Member Of" tab. If any groups are listed, this is a finding. 11. Click on the "Remote Desktop Services Profile" tab. If the "Deny this user permissions to log on to Remote Desktop Session Host server" is not checked, this is a finding. 12 Repeat steps 8 through 11 for each user that runs a ColdFusion service. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Execute the command: grep -i -m 1 runtime_user coldfusion_11 4. The user being used to execute ColdFusion will be listed. 5. View the user within the /etc/passwd file. 6. Make note of the user id and group id. For example, if the line in the passwd file is cfuser:x:500:501:ColdFusion:/home/cfuser:/sbin/nologin, the user id is 500 and the group id is 501. If the user id or the group id is set to 0 (zero), this is a finding.

Fix: F-68353r2_fix

For ColdFusion running on Windows: 1. Create a user for the ColdFusion services by running the snap-in compmgmt.msc. 2. Expand the "Local Users and Groups" in the left pane under "System Tools" to view the "Users" and "Groups" folders. 3. Select the "Users" folder. 4. Right click in the right pane and select "New User". 5. Enter a username and password for the user. Follow any organization specific policies in place and Windows STIGs for password complexity, usernames, etc. 6. Select the "Create" button to create the user. 7. Right click on the new user and select the "Properties" menu item. 8. Select the "Member Of" tab. 9. Remove all groups. 10. Select the "Remote Desktop Services Profile" tab. 11. Check the "Deny this user permissions to log on to Remote Desktop Session Host server" checkbox. 12. Select the "Apply" button. 13. Run the snap-in services.msc. 14. Locate the ColdFusion services. 15. Right click on a ColdFusion service and select "Properties". 16. Select the "Log On" tab. 17. Click on the "This account:" radio button. 18. Enter the username and password for the user account that was just created. 19. Select "Ok" to save the changes. 20. Repeat steps 15 through 19 for each ColdFusion service. ColdFusion running on Linux: 1. Create a group for the user account that will run the ColdFusion service by executing the command groupadd. For example, if the group being created is webusers, the command would be: groupadd webusers 2. Create the user account for the service by executing the command adduser. For example, if the user being created is cfuser with the group webusers, the command would be: adduser -g webusers -s /sbin/nologin -M -c ColdFusion cfuser 3. Assign a password to the account that follows any organization password policies in place and the OS STIG for password complexity. The password is assigned by executing the command: passwd cfuser 4. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 5. Change to the directory where the file is located. 6. Edit the coldfusion_11 file. 7. Locate the text RUNTIME_USER= within coldfusion_11 8. Update the user account being used to run the ColdFusion service.

b

ColdFusion accounts with access to the Administrator Console must be approved.

CM-6 - Medium - CCI-000366 - V-62435 - SV-76925r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000112

Vuln IDs

V-62435

Rule IDs

SV-76925r1_rule

ColdFusion offers an Administrator Console that is used to setup ColdFusion. The console allows the administrator to setup user accounts, user privileges, logging, data sources, etc. These accounts, once setup, do not automatically lock after a set duration of inactivity or any other security event that would require automatic locking or deletion. This would enable an account for a user who either left the organization or changed job roles, to continue access the console until the account is manually deleted. To make certain that the user accounts are only those that are needed, the accounts must be approved by the ISSM.

Checks: C-63239r1_chk

Review the users within the "User Manager" page under the "Security" menu. If users exist that are not approved by the ISSM, this is a finding.

Fix: F-68355r1_fix

Navigate to the "User Manager" page under the "Security" menu. Modify the list of users to only contain those approved by the ISSM.

b

ColdFusion must protect newly created objects.

CM-6 - Medium - CCI-000366 - V-62437 - SV-76927r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000113

Vuln IDs

V-62437

Rule IDs

SV-76927r1_rule

During operation, ColdFusion may create objects such as files to store parameters or log data, or pipes to share data between objects. When the objects are created, it is important that the newly created object has the correct permissions. This can be performed by assigning the proper umask value to the running process. For the ColdFusion service, the umask must be set to 007 or more restrictive.

Checks: C-63241r1_chk

For ColdFusion running on Windows, this finding is not applicable. ColdFusion running on Linux: 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Locate the umask setting. It should be located near the top of the file, but below the #description comment. If the umask is not set to 007 or more restrictive, this is a finding.

Fix: F-68357r1_fix

For ColdFusion running on Windows, this finding is not applicable. 1. Locate the file coldfusion_11 by running the command: find / -name coldfusion_11 2. Change to the directory where the file is located. 3. Edit the coldfusion_11 file. 4. Add the umask setting near the top of the file, but below the #description comment. A sample umask setting looks like: umask 007

b

ColdFusion must have Sandbox Security enabled.

CM-6 - Medium - CCI-000366 - V-62439 - SV-76929r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000114

Vuln IDs

V-62439

Rule IDs

SV-76929r1_rule

Application isolation allows multiple applications to run on the same hosting operating system, web server and application server. Typical reasons to isolate applications are to separate different application user bases, data security levels, protect application resources, and to give least privileges to each application to system resources. Application isolation will also contain an application that has been compromised from compromising other hosted applications. To allow sandboxing to be implemented, the feature must be enabled.

Checks: C-63243r1_chk

Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If "Enable ColdFusion Sandbox Security" is unchecked, this is a finding.

Fix: F-68359r1_fix

Navigate to the "Sandbox Security" page under the "Security" menu. Check "Enable ColdFusion Sandbox Security" and select the "Submit Changes" button.

b

ColdFusion must have Sandboxes defined for application execution.

CM-6 - Medium - CCI-000366 - V-62441 - SV-76931r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000115

Vuln IDs

V-62441

Rule IDs

SV-76931r1_rule

Application isolation allows multiple applications to run on the same hosting operating system, web server and application server. Typical reasons to isolate applications are to separate different application user bases, data security levels, protect application resources, and to give least privileges to each application to system resources. Application isolation will also contain an application that has been compromised from compromising other hosted applications. To implement sandboxing, sandboxes must be setup to separate applications. Enabling the feature without implementing sandboxes does not secure the system.

Checks: C-63245r1_chk

Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. Sandboxes should be setup for the Administrator Console and any other hosted applications. The Administrator Console must have its own sandbox separate from the other hosted applications. If there are no sandboxes implemented for the Administrator Console and the other hosted applications, this is a finding.

Fix: F-68361r1_fix

Navigate to the "Sandbox Security" page under the "Security" menu. Create sandboxes for the applications to operate within and select the "Submit Changes" button.

b

ColdFusion must have the Default ScriptSrc Directory set to a non-default value.

CM-6 - Medium - CCI-000366 - V-62443 - SV-76933r1_rule

RMF Control

CM-6

Severity

M

CCI

Version

CF11-03-000116

Vuln IDs

V-62443

Rule IDs

SV-76933r1_rule

The scripts directory contains common javascript code that may be used by the hosted applications. This code is offered to help the developer with common data controls and functions aiding in the quick development of applications. Unfortunately, this code has also been known to have security vulnerabilities. Because of this, many of the ColdFusion hacking tools look for this directory in the default location searching for files with known vulnerabilities. By moving the directory to a non-default location, the hacking tools are unable to find the directory making it more difficult for the attacker.

Checks: C-63247r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Default ScriptSrc Directory" is set to /CFIDE/scripts/", this is a finding.

Fix: F-68363r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Enter the new location for the ScriptSrc Directory.

c

ColdFusion must contain the most recent update.

CM-6 - High - CCI-000366 - V-62445 - SV-76935r1_rule

RMF Control

CM-6

Severity

H

CCI

Version

CF11-03-000117

Vuln IDs

V-62445

Rule IDs

SV-76935r1_rule

ColdFusion releases updates to ColdFusion 11 to add support, fix bugs and close security issues. Without the current update installed, the product may be unstable or become a target for an attacker who can take advantage of a known exploit. The updates, when available, must be tested and installed as soon as possible.

Checks: C-63249r1_chk

Within the Administrator Console, navigate to the "Updates" page under the "Server Update" menu. If the "Available Updates" tab is showing that updates are available, this is a finding. A list of updates available can be retrieved from the update site. Enter the "Settings" tab and copy the URL listed in the "Site URL" field. Paste the URL into a browser and make note of the newest update available. If the "Site URL" field is empty or if a local update server is being used and the site does not list the updates, the ColdFusion update site can be reached at https://helpx.adobe.com/coldfusion/kb/coldfusion-11-updates.html Enter the "Installed Updates" tab and verify that the update installed is the latest listed on the update site. If the latest update is not installed, this is a finding.

Fix: F-68365r1_fix

Navigate to the "Update" page under the "Server Update" menu. Enter the "Available Updates" tab and install the latest patch available. If the ColdFusion server is patched from the command line and not through the ColdFusion Console, the latest patch must be downloaded manually, the hash value verified and then installed using the instructions provided with the patch.

b

ColdFusion must have example collections removed.

CM-7 - Medium - CCI-000381 - V-62447 - SV-76937r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000118

Vuln IDs

V-62447

Rule IDs

SV-76937r1_rule

ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.

Checks: C-63251r1_chk

Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "ColdFusion Collections" page under the "Data & Services" menu. If the bookclub collection exists, this is a finding.

Fix: F-68367r1_fix

Remove the sample collections by navigating to the "ColdFusion Collections" page under the "Data & Services" menu. Delete the bookclub collection.

b

ColdFusion must have example gateway instances removed.

CM-7 - Medium - CCI-000381 - V-62449 - SV-76939r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

CF11-03-000119

Vuln IDs

V-62449

Rule IDs

SV-76939r1_rule

ColdFusion is installed with sample data services, gateway services, and collections. These can be used in a development environment to learn how to use and develop applications and services, but these samples are not tested and patched for security issues. Allowing them to be available on a production system provides a gateway to an attacker to the application server and to those systems connected to ColdFusion. To alleviate this issue, sample code and services must be deleted.

Checks: C-63253r1_chk

Several sample services are installed with the ColdFusion server. From the Administrator Console, go to the "Gateway Instances" page under the "Event Gateways" menu. If the Gateway Instance SMS Menu App. exists, this is a finding.

Fix: F-68369r1_fix

Remove the sample gateway instances by navigating to the "Gateway Instances" page under the "Event Gateways" menu. Delete the Gateway Instance SMS Menu App.

b

ColdFusion must authenticate users individually.

IA-2 - Medium - CCI-000770 - V-62451 - SV-76941r1_rule

RMF Control

IA-2

Severity

M

CCI

CCI-000770

Version

CF11-04-000128

Vuln IDs

V-62451

Rule IDs

SV-76941r1_rule

To assure individual accountability and prevent unauthorized access, application server users must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. ColdFusion is installed with a Root Administrator Account. This account is configured during the installation phase. This account should only be used for initial setup before user accounts are created and should not be used for day-to-day operations. When used as a group account, accountability, along with least privileges for the users, is lost.

Checks: C-63255r1_chk

Within the Administrator Console, navigate to the "User Manager" page under the "Security" menu. If there are no defined users, this is a finding.

Fix: F-68371r1_fix

Navigate to the "User Manager" page under the "Security" menu. Create users that need access to the Administrator Console providing only the roles necessary to perform each job function.

b

ColdFusion must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.

IA-2 - Medium - CCI-001941 - V-62453 - SV-76943r1_rule

RMF Control

IA-2

Severity

M

CCI

CCI-001941

Version

CF11-04-000129

Vuln IDs

V-62453

Rule IDs

SV-76943r1_rule

Application servers may provide a web services capability that could be leveraged to allow remote access to sensitive application data. Many web services utilize SOAP, which in turn utilizes XML and HTTP as a transport. Natively, SOAP does not provide security protections. As such, the application server must provide security extensions to enhance SOAP capabilities to ensure that secure authentication mechanisms are employed to protect sensitive data. The ws-security suite is a widely used and acceptable SOAP security extension. ColdFusion offers SOAP capabilities but does not offer any type of security for these services. In order to extend the security of the SOAP protocol, an administrator must install the ws-security suite to enhance SOAP through Java Web Services and configure the ws-security features within the new object. This new object then becomes the wrapper for the SOAP communication, securing the sensitive data.

Checks: C-63257r1_chk

Determine if web services are published using the SOAP protocol to access sensitive data. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Determine if the ws-security suite is in place to provide secure authentication to the sensitive data by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If web services are published using the SOAP protocol to access sensitive data and the ws-security suite is not used to secure the access, this is a finding.

Fix: F-68373r1_fix

If web services are not published, this finding is not applicable. If web services are published, but the SOAP protocol is not used, this finding is not applicable. If web services are published and the SOAP protocol is used to access data, but the data is not sensitive, this finding is not applicable. Install the ws-security suite to secure access to sensitive data.

b

ColdFusion must transmit only encrypted representations of passwords for Flex Integration.

IA-5 - Medium - CCI-000197 - V-62455 - SV-76945r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000197

Version

CF11-04-000133

Vuln IDs

V-62455

Rule IDs

SV-76945r1_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion offers RMI communication between Flex and ColdFusion. The communication between the two will require authentication data. When authentication data is transmitted, the data must be encrypted to protect it from discovery. This can be done by enabling RMI over SSL within the Administrator Console.

Checks: C-63259r1_chk

Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. Ask the administrator if Flex is being used and if user credentials are being used for authentication. If user credentials are being used for Flex authentication to ColdFusion and "Enable RMI over SSL for Data Management" is not checked, this is a finding.

Fix: F-68375r1_fix

Navigate to the "Flex Integration" page under the "Data & Services" menu. Check "Enable RMI over SSL for Data Management" and select the "Submit Changes" button.

b

The ColdFusion Administrator Console must transmit only encrypted representations of passwords.

IA-5 - Medium - CCI-000197 - V-62457 - SV-76947r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000197

Version

CF11-04-000134

Vuln IDs

V-62457

Rule IDs

SV-76947r1_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion uses username and password for users to authenticate to the Administrator Console. When these credentials are sent in plaintext, an attacker can capture the information and use the credentials to log on to the console, creating objects, connections, and accounts for later use. The attacker will also have access to information stored for connections to other systems that ColdFusion may be connected to for data retrieval.

Checks: C-63261r1_chk

Access the Administrator Console through a web browser. Look for indications that the communication is an https session through the prefix of https on the url and/or the lock icon, depending on the browser in use. If https does not appear to be in use, this is a finding.

Fix: F-68377r1_fix

Review the documentation for the web server where the Administrator Console is being hosted and setup https encryption to protect passwords during the authentication process.

b

ColdFusion must transmit only encrypted representations of passwords to the mail server.

IA-5 - Medium - CCI-000197 - V-62459 - SV-76949r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000197

Version

CF11-04-000135

Vuln IDs

V-62459

Rule IDs

SV-76949r1_rule

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion may use username/password to connect to a mail server. When this authentication method is used, it is important that the credentials be protected when transmitted by being encrypted. While TLS encryption is the preferred method by DoD, SSL can be used when the mail server does not offer any other method of encryption.

Checks: C-63263r2_chk

Within the Administrator Console, navigate to the "Mail" page under the "Server Settings" menu. If a user name and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.

Fix: F-68379r1_fix

Navigate to the "Mail" page under the "Server Settings" menu. Enable SSL/TLS by checking "Enable SSL socket connections to mail server" and/or "Enable TLS connection to mail server" options and select the "Submit Changes" button.

b

Only authenticated system administrators or the designated PKI Sponsor for ColdFusion must have access to ColdFusions private key.

IA-5 - Medium - CCI-000186 - V-62461 - SV-76951r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000186

Version

CF11-04-000138

Vuln IDs

V-62461

Rule IDs

SV-76951r1_rule

The cornerstone of PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and can pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the private keys. Java-based application servers, such as ColdFusion, utilize the Java keystore, which provides storage for cryptographic keys and certificates. ColdFusion uses the keystore to store private keys for ColdFusion WebSockets and for Flex Integration.

Checks: C-63265r1_chk

Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. If "Enable RMI over SSL for Data Management" is checked, make note of the path and filename of the keystore used. Navigate to the "WebSocket" page under the "Server Settings" menu. If "SSL Port" is checked, make note of the keystore path and filename. Review the permissions on the files designated in the keystore locations specified. ColdFusion running on Windows should have full control for the Administrators group and the user running ColdFusion on the keystore file. No other users should have permissions. If permissions are granted to other users or roles, this is a finding. If ColdFusion is installed on Linux, the permissions must be 750 or more restrictive with the owner set to the user running the ColdFusion service and a group of root. If the permissions are more permissive, this is a finding.

Fix: F-68381r2_fix

Locate the keystore file(s). The location can be found in the Administrator Console within the "Flex Integration" page under the "Data & Services" menu and within the "WebSocket" page under the "Server Settings" menu. The keystore(s) should have the following permissions: ColdFusion running on Windows: 1. Right click on the keystore and select "Properties". 2. Click on the "Security" tab and then click the "Advanced" button. 3. On the "Permissions" tab, click the "Disable inheritance" button and select "Remove all inherited permissions from this object." 4. Click the "Add" button, in the permission Entry dialog, click 'Select a principal." 5. Enter the user that is running the ColdFusion service and give this user Full control and click "OK" to save. 6. Click the "Add" button again, in the permission Entry dialog, click "Select a principal." 7. Enter the Administrators group and give the group Full control and click "OK" to save. 8. Check the checkbox to "Replace all child object permission entries with inheritable permission entries from this object." 9. Click "OK" to apply these permissions. ColdFusion running on Linux: Use the chmod command to set the permissions correctly and chown to set the owner and group. For example, if the keystore is named /opt/cf11/jre/lib/security/cacerts and you want to set the owner to cfuser, the commands would be: chown cfuser:root /opt/cf11/jre/lib/security/cacerts chmod 750 /opt/cf11/jre/lib/security/cacerts

b

The ColdFusion Administrator Console must be hosted on a management network.

SC-2 - Medium - CCI-001082 - V-62463 - SV-76953r1_rule

RMF Control

SC-2

Severity

M

CCI

Version

CF11-05-000161

Vuln IDs

V-62463

Rule IDs

SV-76953r1_rule

ColdFusion consists of the Administrator Console and hosted applications. By separating the Administrator Console from hosted applications, the user must authenticate as a privileged user to the Administrator Console before being presented with management functionality. This prevents non-privileged users from having visibility to functions not available to the user. By limiting visibility, a compromised non-privileged account does not offer information to the attacker to functionality and information needed to further the attack on the application server. By hosting the Administrator Console on a management-only network, the console is protected from hosted application users, is isolated to only management devices, is not vulnerable to accidental discovery, and most management networks encrypt all traffic protecting management data from accidental disclosure.

Checks: C-63267r1_chk

Access the Administrator Console through a browser making note of the IP address that is used to access the console. Review the site's network diagram to validate that the IP used is on a management network and is separate from the public network. If the Administrator Console is not part of a management network, this is a finding.

Fix: F-68383r1_fix

Host the ColdFusion Administrator Console on a management network.

b

The ColdFusion Administrator Console must be hosted in a management sandbox.

SC-2 - Medium - CCI-001082 - V-62465 - SV-76955r1_rule

RMF Control

SC-2

Severity

M

CCI

Version

CF11-05-000162

Vuln IDs

V-62465

Rule IDs

SV-76955r1_rule

ColdFusion consists of the Administrator Console and hosted applications. By separating the Administrator Console from hosted applications, the user must authenticate as a privileged user to the Administrator Console before being presented with management functionality. This prevents non-privileged users from having visibility to functions not available to the user. By limiting visibility, a compromised non-privileged account does not offer information to the attacker to functionality and information needed to further the attack on the application server. By hosting the Administrator Console within its own sandbox from other hosted applications, the administrative objects are protected from reuse and modification by the other hosted applications.

Checks: C-63269r1_chk

Within the Administrator Console, navigate to the "Sandbox Security" page under the "Security" menu. If the Administrator Console is not hosted within a sandbox, this is a finding.

Fix: F-68385r1_fix

Navigate to the "Sandbox Security" page under the "Security" menu. Create sandbox for the Administrator Console to operate within and select the "Submit Changes" button.

b

ColdFusion must disable creation of unnamed applications.

SC-2 - Medium - CCI-001082 - V-62467 - SV-76957r1_rule

RMF Control

SC-2

Severity

M

CCI

Version

CF11-05-000163

Vuln IDs

V-62467

Rule IDs

SV-76957r1_rule

ColdFusion allows applications to be named or unnamed. The application name allows the developer to scope the application or define a logical application and allows for the separation of applications. When an application is unnamed, the application scope corresponds to the ColdFusion JEE servlet context. This also means that the application session corresponds directly to the session object of the JEE application server. Having unnamed applications is only necessary when the ColdFusion pages must share application or session scope data with existing JSP pages and servlets. Disabling the ability for unnamed applications allows the Administrator Console and all the other hosted applications to be isolated from each other.

Checks: C-63271r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Disable creation of unnamed applications" is unchecked, this is a finding.

Fix: F-68387r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable creation of unnamed applications" and select the "Submit Changes" button.

b

ColdFusion must not allow application variables to be added to Servlet Context.

SC-2 - Medium - CCI-001082 - V-62469 - SV-76959r1_rule

RMF Control

SC-2

Severity

M

CCI

Version

CF11-05-000164

Vuln IDs

V-62469

Rule IDs

SV-76959r1_rule

ColdFusion allows applications to add application variables to the Servlet Context. This allows an application to add data or change configuration data for all hosted applications. By sharing data across applications, the applications are no longer isolated with one application affecting other applications. By disabling this capability, the hosted applications, including the Administrator Console, are isolated.

Checks: C-63273r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allow adding application variables to Servlet Context" is checked, this is a finding.

Fix: F-68389r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Allow adding application variables to Servlet Context" and select the "Submit Changes" button.

b

ColdFusion must enable UUID for session identifier generation.

SC-23 - Medium - CCI-001664 - V-62471 - SV-76961r1_rule

RMF Control

SC-23

Severity

M

CCI

CCI-001664

Version

CF11-05-000167

Vuln IDs

V-62471

Rule IDs

SV-76961r1_rule

Unique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of session identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. ColdFusion offers session ID randomness and uniqueness by enabling UUID for the session ID. Without this option enabled, session values are sequential and become easy to hijack through guessing.

Checks: C-63275r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Use UUID for cftoken" is not checked, this is a finding.

Fix: F-68391r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Check "Use UUID for cftoken" and select the "Submit Changes" button.

b

ColdFusion must use J2EE session variables.

SC-23 - Medium - CCI-001664 - V-62473 - SV-76963r1_rule

RMF Control

SC-23

Severity

M

CCI

CCI-001664

Version

CF11-05-000168

Vuln IDs

V-62473

Rule IDs

SV-76963r1_rule

Unique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of session identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. By enabling J2EE session management, each session is given a unique and non-sequential session id which is shared between the JVM and the ColdFusion application allowing for easier session management. J2EE session management stores the session data within a cookie stored in memory which will only exist while the session is valid. When J2EE sessions management is not used, the cookie is stored on the hard drive allowing for a cookie that can be easily harvested by an attacker.

Checks: C-63277r1_chk

Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Use J2EE session variables" is not checked, this is a finding.

Fix: F-68393r1_fix

Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Use J2EE session variables" and select the "Submit Changes" button.

b

ColdFusion must set session cookies as browser session cookies.

SC-23 - Medium - CCI-001664 - V-62475 - SV-76965r1_rule

RMF Control

SC-23

Severity

M

CCI

CCI-001664

Version

CF11-05-000169

Vuln IDs

V-62475

Rule IDs

SV-76965r1_rule

Generating a unique session identifier for each session inhibits an attacker from using an already authenticated session identifier that has not been invalidated. If an attacker is able to use an authenticated session, the attacker is given the privileges of the user who created the session. This may allow the attacker to generate user accounts for later use, change configuration settings, deploy an application or change application modules and code for already hosted applications, or see usernames for trusted relationships to other resources. It is important that each new session is given a new and unique session identifier and that old identifiers are discarded quickly. ColdFusion offers the capability to set session Cookies and all other Cookies to browser cookies. This means all cookies become invalid once the browser window is closed instead of setting a time to live to the cookie. Setting the cookies to browser cookies will ensure the session identifier is invalidated once the user ends the session through closing the browser.

Checks: C-63279r1_chk

Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Cookie Timeout" is not set to -1, this is a finding.

Fix: F-68395r1_fix

Navigate to the "Memory Variables" page under the "Server Settings" menu. Set the parameter "Cookie Timeout" to -1 and select the "Submit Changes" button.

b

ColdFusion must provide a clustering capability.

SC-24 - Medium - CCI-001190 - V-62477 - SV-76967r1_rule

RMF Control

SC-24

Severity

M

CCI

CCI-001190

Version

CF11-05-000173

Vuln IDs

V-62477

Rule IDs

SV-76967r1_rule

Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. When application failure is encountered, preserving application state facilitates application restart and return to the operational mode of the organization with less disruption of mission/business processes. Clustering of multiple ColdFusion servers is a common approach to providing fail-safe application availability when the system criticality requires redundancy.

Checks: C-63281r1_chk

This requirement is dependent upon system mission criticality. If the system is not mission critical and does not require redundancy, this finding is not applicable. Within the Administrator Console, navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Verify that there are configured clusters with more than 1 server in each cluster. If there are no clusters defined or there is only one server in the cluster, this is a finding.

Fix: F-68397r1_fix

Navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Create a cluster by defining a name and adding it to the configured clusters. Edit the cluster to add available servers to the cluster and submit the changes to the cluster.

b

ColdFusion must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.

SC-23 - Medium - CCI-002470 - V-62479 - SV-76969r1_rule

RMF Control

SC-23

Severity

M

CCI

CCI-002470

Version

CF11-05-000178

Vuln IDs

V-62479

Rule IDs

SV-76969r1_rule

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established. The DoD will only accept PKI certificates obtained from a DoD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. The application server must only allow the use of DoD PKI-established certificate authorities for verification. ColdFusion uses the underlying JVM and keystore for storing and certificates and for use within connections for data transfer. These certificates must be checked to ensure the certificates are from DoD PKI-established certificate authorities.

Checks: C-63283r1_chk

Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. To view the certificates stored within this file, execute the java command keytool -list -v -keystore ./cacerts and verify that the Certificate Authority (CA) for each certificate is DoD-approved. If any certificates have a CA that is not DoD-approved, this is a finding.

Fix: F-68399r2_fix

Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. Remove the certificates that have a CA that is non-DoD approved and import DoD CA-approved certificates.

b

ColdFusion, when part of a mission critical system, must be in a high-availability (HA) cluster.

SC-5 - Medium - CCI-002385 - V-62481 - SV-76971r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000181

Vuln IDs

V-62481

Rule IDs

SV-76971r1_rule

A mission critical system is a system that handles data vital to the organization's operational readiness or effectiveness of deployed or contingency forces. A mission critical system must maintain the highest level of integrity and availability. By High Availability (HA) clustering the ColdFusion application server, the hosted application and data are given a platform that is load-balanced and provides high-availability. Most HA clusters consist of two nodes, which is the minimum required for redundancy, but HA clusters can consist of many more nodes. ColdFusion does offer a clustering capability that must be used when the ColdFusion application server is part of a mission critical system.

Checks: C-63285r1_chk

If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Validate that two or more servers have been defined and that the servers are on different hosts. If there are fewer than two servers available or the servers are on the same host, this is a finding. Navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. If there are no clusters defined or any cluster has fewer than two servers in the cluster, this is a finding.

Fix: F-68401r1_fix

If ColdFusion is not part of a mission critical system, this requirement is not applicable. Within the Administrator Console, navigate to the "Instance Manager" page under the "Enterprise Manager" menu. Define two or more servers to be part of each cluster. Once the servers are defined for the cluster(s), navigate to the "Cluster Manager" page under the "Enterprise Manager" menu. Define clusters for your mission critical ColdFusion installation. Each defined cluster must contain two or more servers.

b

ColdFusion must not store user information in the server registry.

SC-5 - Medium - CCI-002385 - V-62483 - SV-76973r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000182

Vuln IDs

V-62483

Rule IDs

SV-76973r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to fill the server hard drive with data or to cause registry purges on a large registry. Filling the drive with data can be achieved if applications have client management enabled and client data is stored within the registry. If a scheduled purge is performed on the registry, ColdFusion must load the entire registry into memory and look at each entry to determine if the entry needs to be purged. The purging process can use all of the available memory and 100% of the CPU for a process that may only delete a few entries. Also, the registry is typically located on the system partition. Because of these factors, the use of the registry to store client sessions must not be used.

Checks: C-63287r1_chk

Within the Administrator Console, navigate to the "Client Variables" page under the "Server Settings" menu. If the default storage mechanism for client sessions is set to "Registry", this is a finding.

Fix: F-68403r1_fix

Navigate to the "Client Variables" page under the "Server Settings" menu. Set the default storage mechanism for client sessions to any available mechanism other than the registry and select the "Apply" button.

b

ColdFusion must limit the maximum number of Flash Remoting requests.

SC-5 - Medium - CCI-002385 - V-62485 - SV-76975r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000183

Vuln IDs

V-62485

Rule IDs

SV-76975r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is Flash Remoting. Flash Remoting is a service that allows flash applications to interact with ColdFusion pages and, if being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When not in use, this setting must be set to 1.

Checks: C-63289r1_chk

Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if flash remoting is being used (Note: The Server Monitor feature in ColdFusion Enterprise makes use of flash remoting.). If flash remoting is being used, this finding is not applicable. If "Maximum number of simultaneous Flash Remoting requests" is not set to 1, this is a finding.

Fix: F-68405r1_fix

If flash remoting is being used, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Flash Remoting requests" to 1 and select the "Submit Changes" button.

c

ColdFusion must limit the SQL commands available.

SC-5 - High - CCI-002385 - V-62487 - SV-76977r1_rule

RMF Control

SC-5

Severity

H

CCI

Version

CF11-05-000184

Vuln IDs

V-62487

Rule IDs

SV-76977r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Allowing hosted applications to execute SQL commands that create tables, change permissions on objects, create stored procedures, or drop objects allow an attacker to put the hosted application into a posture where it may not work correctly, display error messages that contains sensitive data that was not tested for during development, or cause an application to be unable to authenticate users. Any of these situations puts the system into a situation where the user is denied service to the application. Giving applications only those SQL commands needed to operate on data reduces this risk.

Checks: C-63291r1_chk

Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. If any of the data sources have CREATE, GRANT, DROP, REVOKE or ALTER checked, this is a finding.

Fix: F-68407r1_fix

If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. Uncheck the allow SQL of CREATE, GRANT, DROP, REVOKE and ALTER and select the "Submit" button.

b

ColdFusion must set a query timeout for Data Sources.

SC-5 - Medium - CCI-002385 - V-62489 - SV-76979r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000185

Vuln IDs

V-62489

Rule IDs

SV-76979r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by executing a query that will never return or timeout. By having no timeout set, this type of DoS would be available to an attacker. By setting a value greater than 0 (0 means no timeout), the query would be stopped and the resources released.

Checks: C-63293r1_chk

Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" Settings menu. If there are no data sources defined, this finding is not applicable. Edit each data source and then view the advanced settings by pressing the "Show Advanced Settings" button. Check to see if the data source has the capability to specify a query timeout. If available, this parameter must not be 0 (No Timeout). If a data source does not have this setting, then this is not a finding for this data source. If any of the data sources have a query timeout set to 0, this is a finding.

Fix: F-68409r1_fix

If there are no data sources defined, this finding is not applicable. Navigate to the "Data Sources" page under the "Data & Services" Settings menu. Edit each data source and view the advanced settings. If the data source has a query timeout parameter, set the timeout parameter to a value greater than 0 and select the "Submit" button.

b

ColdFusion must limit the maximum number of Web Service requests.

SC-5 - Medium - CCI-002385 - V-62491 - SV-76981r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000186

Vuln IDs

V-62491

Rule IDs

SV-76981r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is Web Services. Web Services are services that allow an application to publish SOAP web services and when being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When not in use, this setting must be set to 1.

Checks: C-63295r1_chk

Determine if web services are being published for the hosted applications. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation, published web services design documentation or ColdFusion baseline documentation. If Web Services are being published for hosted applications, this find is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If Web Services are not being published for hosted applications and the "Maximum number of simultaneous CFC function requests" is not set to 1, this is a finding.

Fix: F-68411r1_fix

If Web Services are being published for hosted applications, this find is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Web Service requests" to 1 and select the "Submit Changes" button.

b

ColdFusion must limit the maximum number of CFC function requests.

SC-5 - Medium - CCI-002385 - V-62493 - SV-76983r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000187

Vuln IDs

V-62493

Rule IDs

SV-76983r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is remote ColdFusion Component (CFC) requests. Remote CFC requests allow ColdFusion components to be called directly from an http/https url. If this feature is being used, the number of simultaneous requests should be tuned using load testing to find the optimal value for the setting. When the feature is not in use, the maximum number must be set to 1.

Checks: C-63297r1_chk

Determine if CFC functions are being called directly from http/https for any hosted application. This may be determined by interviewing the administrator or by reviewing hosted applications code, hosted application design documentation or ColdFusion baseline documentation. If CFC requests are being used by hosted applications, this finding is not applicable. Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If the CFC requests are not being used b hosted applications and "Maximum number of simultaneous CFC function requests" is not set to 1, this is a finding.

Fix: F-68413r1_fix

If CFC requests are being used by hosted applications, this finding is not applicable. Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous CFC function requests" to 1 and select the "Submit Changes" button.

b

ColdFusion must limit the maximum number of simultaneous Report threads.

SC-5 - Medium - CCI-002385 - V-62495 - SV-76985r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000188

Vuln IDs

V-62495

Rule IDs

SV-76985r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Report threads are used to process reports concurrently. Since reporting in most applications is a process that is not time sensitive or heavily used, this setting should be minimized to minimize resource use on the application server and to minimize a method that could be used to exhaust resources by an attacker. Unless reporting is heavily used, the number of simultaneous report threads must be set to 1.

Checks: C-63299r1_chk

Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Maximum number of simultaneous Report threads" is not set to 1, this is a finding.

Fix: F-68415r1_fix

Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Maximum number of simultaneous Report threads" to 1 and select the "Submit Changes" button.

b

ColdFusion must limit the maximum number of threads available for CFTHREAD.

SC-5 - Medium - CCI-002385 - V-62497 - SV-76987r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000189

Vuln IDs

V-62497

Rule IDs

SV-76987r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. One way to cause a DoS for ColdFusion is to exhaust resources by using services that are not being monitored because of their nonuse by hosted applications. One of these services is the CFTHREAD function. CFTHREAD allows a programmer to create threads of code that execute independently. If this feature is being used, the maximum number of threads should be tuned. If set to high, this may lead to a context-switching situation. When this feature is not in use, the maximum number of threads must be 1.

Checks: C-63301r1_chk

Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Ask the administrator if threading, calls to CFTHREAD, is being used by any of the hosted application. If threading is being used, this finding is not applicable. If threading is not being used and "Maximum number of threads available for CFTHREAD" is not set to 1, this is a finding.

Fix: F-68417r1_fix

If threading is being used, this finding is not applicable. Navigate to the "Request Tuning page under the Server Settings" menu. Set "Maximum number of threads available for CFTHREAD" to 1 and select the "Submit Changes" button.

b

ColdFusion must set a timeout for requests.

SC-5 - Medium - CCI-002385 - V-62499 - SV-76989r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000190

Vuln IDs

V-62499

Rule IDs

SV-76989r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. The "Timeout Requests after" setting is used to terminate requests that have not been fulfilled in the set time. This parameter prevents unusually long requests from occupying server resources and impairing performance or denying other requests. This value should be set to 5 or less and match the value for "Timeout requests waiting in queue after" setting.

Checks: C-63303r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Timeout Requests after seconds" is not checked or is set higher than 5, this is a finding.

Fix: F-68419r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Check "Timeout Requests after seconds" and set the value to 5 or less and select the "Submit Changes" button.

b

ColdFusion must set a timeout for logins.

SC-5 - Medium - CCI-002385 - V-62501 - SV-76991r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000191

Vuln IDs

V-62501

Rule IDs

SV-76991r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. The "Login Timeout" setting is used to terminate login attempts on data sources that have not been fulfilled in the set time. This parameter prevents unusually long logins from occupying server resources and impairing performance. This value should be set to 5 or less and be less than or equal to the value for "Timeout Requests after" setting.

Checks: C-63305r1_chk

Within the Administrator Console, navigate to the "Data Sources" page under the "Data & Services" menu. If there are no data sources defined, this finding is not applicable. For each Data Source, view the "Login Timeout (sec)" setting within the Advanced Settings for the data source by editing the data source and then pressing the "Show Advanced Settings" button. If there are any data sources with a "Login Timeout (sec)" set higher than 5, this is a finding.

Fix: F-68421r1_fix

Navigate to the "Data Sources" page under the "Data & Services" menu. Edit each data source and set the "Login Timeout (sec)" to 5 or less within the advanced settings for the data source.

b

ColdFusion must limit the time-out for requests waiting in the queue.

SC-5 - Medium - CCI-002385 - V-62503 - SV-76993r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000192

Vuln IDs

V-62503

Rule IDs

SV-76993r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. By setting a timeout for requests in queue, the queue is kept clear and not filled by requests that can never be filled. If an attacker were able to fill the queue with requests that never expired, the system would eventually fail. For DoD systems, this setting must be set to 5 or lower and should match the "Timeout Requests After" value.

Checks: C-63307r1_chk

Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. If "Timeout requests waiting in queue after" setting is set higher than 5, this is a finding.

Fix: F-68423r1_fix

Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Timeout requests waiting in queue after" to 5 or less and select the "Submit Changes" button.

a

ColdFusion must have a custom request queue time-out page.

SC-5 - Low - CCI-002385 - V-62505 - SV-76995r1_rule

RMF Control

SC-5

Severity

L

CCI

Version

CF11-05-000193

Vuln IDs

V-62505

Rule IDs

SV-76995r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Limiting the knowledge given to an attacker about the effects of his attack and possible solutions to further his attack is important. This is especially important when the attacker is trying to find the limits needed to exhaust resources and cause a DoS. To limit feedback to the attacker on his efforts, a custom time-out page should be used. The message returned should only inform the user that they should wait and retry their request again. The message must not disclose that the queue timed out.

Checks: C-63309r1_chk

Within the Administrator Console, navigate to the "Request Tuning" page under the "Server Settings" menu. Validate that the "Request Queue Timeout Page" setting is set to a valid and custom page. If "Request Queue Timeout Page" is blank or is set to /CFIDE/administrator/templates/request_timeout_error.cfm, this is a finding. If a page is specified, validate that the file exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Request Queue Timeout Page" is set to /CFIDE/administrator/templates/timeout_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/timeout_error.cfm If the "Request Queue Timeout Page" setting is not set to a valid page, this is a finding.

Fix: F-68425r1_fix

Navigate to the "Request Tuning" page under the "Server Settings" menu. Set "Request Queue Timeout Page" to a custom and valid error page and select the "Submit Changes" button.

b

ColdFusion must limit the maximum number of POST requests parameters.

SC-5 - Medium - CCI-002385 - V-62507 - SV-76997r1_rule

RMF Control

SC-5

Severity

M

CCI

Version

CF11-05-000194

Vuln IDs

V-62507

Rule IDs

SV-76997r1_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. To reduce the possibility or effect of a DoS, the application server must employ defined security safeguards. These safeguards will be determined by the placement of the application server and the type of applications being hosted within the application server framework. Limiting the number of POST requests to the maximum number of form fields on any given page within the hosted application is used to mitigate the DoS attack known as HashDOS. For DoD systems, this parameter must be set to 50 or less.

Checks: C-63311r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Maximum number of POST request parameters" is set greater than 50, this is a finding.

Fix: F-68427r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Set "Maximum number of POST request parameters" to 50 or less and select the "Submit Changes" button.

b

ColdFusion must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.

SC-8 - Medium - CCI-002418 - V-62509 - SV-76999r1_rule

RMF Control

SC-8

Severity

M

CCI

CCI-002418

Version

CF11-05-000195

Vuln IDs

V-62509

Rule IDs

SV-76999r1_rule

Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), but care must also be taken to safeguard against non-FIPS approved SSL versions being used. These older versions contain vulnerabilities that have been addressed in the newer FIPS 140-2 approved TLS releases. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. TLS must be enabled, and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. ColdFusion uses JVM to control the encryption of transmitted data. Settings for JVM can be controlled within the Administrator Console to configure the JVM to only use FIPS 140-2 approved TLS and disable non-FIPS SSL versions.

Checks: C-63313r1_chk

Review the setting "JVM arguments" within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. The parameter -Dhttps.protocols is used to set the TLS versions that the JVM can use. Valid values for this setting must be TLS versions 1.0 or higher. An example settings to use TLS versions 1.2, 1.1 and 1.0 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 and an example to only use TLS version 1.2 is -Dhttps.protocols=TLSv1.2 If the "JVM arguments" setting does not contain the parameter -Dhttps.protocols or if the parameter -Dhttps.protocols contains any SSL versions, this is a finding.

Fix: F-68429r1_fix

Navigate to the "JVM arguments" setting within the Administrator Console. These arguments can be found in the "Java and JVM" page accessed through the "Server Settings" menu option. Add the parameter -Dhttps.protocols and set the parameter to the TLS versions to be used. A sample setting to use TLSv1.2, TLSv1.1 and TLSv1 is -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1. SSL versions must not be added to this parameter. Once the parameter is added to the JVM arguments, select the "Submit Changes" button to save the changes and restart the ColdFusion application server to have the changes take effect.

b

ColdFusion must encrypt cookies.

SC-8 - Medium - CCI-002418 - V-62511 - SV-77001r1_rule

RMF Control

SC-8

Severity

M

CCI

CCI-002418

Version

CF11-05-000196

Vuln IDs

V-62511

Rule IDs

SV-77001r1_rule

Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). Transmission of session cookies is especially important since an attacker can grab the session id and hijack the already authenticated session. There are several methods to protect cookie data, and one of those methods is to encrypt the cookie. This can only be done if all the hosted sites are SSL/TLS enabled.

Checks: C-63315r1_chk

Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "Secure Cookie" is not checked, this is a finding.

Fix: F-68431r1_fix

Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "Secure Cookie" and select the "Submit Changes" button.

b

ColdFusion must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

SC-8 - Medium - CCI-002421 - V-62513 - SV-77003r1_rule

RMF Control

SC-8

Severity

M

CCI

CCI-002421

Version

CF11-05-000197

Vuln IDs

V-62513

Rule IDs

SV-77003r1_rule

Preventing the disclosure or modification of transmitted information requires that application servers take measures to employ approved cryptography in order to protect the information during transmission over the network. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSec tunnel. If data in transit is unencrypted, it is vulnerable to disclosure and modification. If approved cryptographic algorithms are not used, encryption strength cannot be assured. ColdFusion uses the underlying JVM to handle transmission and receiving of data, but ColdFusion does offer to the programmer an encrypt API call to protect the data. This call can use multiple crypto methods, but using FIPS 140-2 is superior to those non-FIPS crypto methods to protect and detect changes to the data. Through JVM arguments set within ColdFusion, the programmer can be forced to only FIPS crypto methods.

Checks: C-63317r1_chk

Within the Administrator Console, navigate to the "Java and JVM" page under the "Server Settings" menu. If the JVM argument-Dcoldfusion.enablefipscrypto=true cannot be found or -Dcoldfusion.enablefipscrypto is set to false, this is a finding.

Fix: F-68433r1_fix

Navigate to the "Java and JVM" page under the "Server Settings" menu. Locate the JVM argument coldfusion.enablefipscrypto. If the argument cannot be found, add the argument as -Dcoldfusion.enablefipscrypto=true. If the parameter is defined but set to false, change the setting to true.

b

ColdFusion must encrypt patch retrieval.

SC-8 - Medium - CCI-002421 - V-62515 - SV-77005r1_rule

RMF Control

SC-8

Severity

M

CCI

CCI-002421

Version

CF11-05-000198

Vuln IDs

V-62515

Rule IDs

SV-77005r1_rule

Checking for patches and downloading those patches for installation must be done through an encrypted connection to protect the patch from modification during transmission and to avoid spoofed updates.

Checks: C-63319r1_chk

If the Administrator Console is used to perform patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console and review the setting "Site URL" within the "Settings" tab. If the URL is not prefixed by https://, this is a finding. If a manual process is used to retrieve patches, verify that a documented process is in place that includes using an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc. If there is not a documented process or the process does not include an encrypted method to download patches, this is a finding.

Fix: F-68435r1_fix

If the Administrator Console is used for patch retrieval, navigate to the "Updates" page under the "Server Update" menu within the console. Locate the "Site URL" setting on the "Settings" tab. Update the URL used for updates to be prefixed with https:// so that the communication is encrypted and select the "Submit Changes" button. If a manual process is used to retrieve patches, document the process to retrieve the patches that uses an encrypted method to download the patches, e.g., VPN tunneling, Secure Copy (SCP), etc.

b

ColdFusion must protect Session Cookies from being read by scripts.

SC-8 - Medium - CCI-002420 - V-62517 - SV-77007r1_rule

RMF Control

SC-8

Severity

M

CCI

CCI-002420

Version

CF11-05-000199

Vuln IDs

V-62517

Rule IDs

SV-77007r1_rule

A cookie can be read by client-side scripts easily if cookie properties are not set properly during preparation for transmission. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HTTPOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.

Checks: C-63321r1_chk

Within the Administrator Console, navigate to the "Memory Variables" page under the "Server Settings" menu. If "HTTPOnly" is unchecked, this is a finding.

Fix: F-68437r1_fix

Navigate to the "Memory Variables" page under the "Server Settings" menu. Check "HTTPOnly" and select the "Submit Changes" button.

c

ColdFusion must prevent JavaScript Object Notation (JSON) hijacking of data.

SC-8 - High - CCI-002420 - V-62519 - SV-77009r1_rule

RMF Control

SC-8

Severity

H

CCI

CCI-002420

Version

CF11-05-000200

Vuln IDs

V-62519

Rule IDs

SV-77009r1_rule

Information can be either unintentionally or maliciously disclosed if not protected during preparation for transmission. An easy way to protect data during preparation for transmission is to use non-default identifiers for data. An example is for JavaScript Object Notation (JSON) to use a prefix other than the default "JSON" prefix, signifying to an attacker an array of data is following. JSON is a lightweight data-interchange format.

Checks: C-63323r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Prefix serialized JSON with" is unchecked, this is a finding.

Fix: F-68439r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Check "Prefix serialized JSON with" and select the "Submit Changes" button.

b

ColdFusion must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.

SC-13 - Medium - CCI-002450 - V-62521 - SV-77011r1_rule

RMF Control

SC-13

Severity

M

CCI

CCI-002450

Version

CF11-05-000203

Vuln IDs

V-62521

Rule IDs

SV-77011r1_rule

Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DoD or CNS creates an integrity risk. The application server must utilize approved DoD or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions. ColdFusion uses an underlying JVM for communication and certificate storage. To validate that the proper certificates are in use, the keystore must be checked.

Checks: C-63325r1_chk

Interview the administrator to determine if ColdFusion is using certificates for PKI. If ColdFusion is not performing any PKI functions, this finding is not applicable. The CA certs are usually stored in a file called cacerts located in the directory $JAVA_HOME/jre/lib/security. If the file is not in this location, use a search command to locate the file or ask the administrator where the certificate store is located. Open a dos shell or terminal window and change to the location of the certificate store. To view the certificates within the certificate store, run the command (In this example, the keystore file is cacerts.): keytool -list -v -keystore cacerts Locate the "OU" field for each certificate within the keystore. The field should contain either DoD or CNSS as the Organizational Unit (OU). If the OU does not show that the certificates are DoD or CNSS supplied, this is a finding.

Fix: F-68441r1_fix

Request a CNSS or DoD Class 3 or Class 4 certificate and add it to the keystore to be used for PKI communication.

b

The ColdFusion missing template handler must be valid.

SI-11 - Medium - CCI-001312 - V-62523 - SV-77013r1_rule

RMF Control

SI-11

Severity

M

CCI

Version

CF11-06-000216

Vuln IDs

V-62523

Rule IDs

SV-77013r1_rule

The structure and content of error messages need to be carefully considered by the organization and development team. Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The missing template handler is used much like the 404 handler for a web server. When the missing template handler is blank, a potential attacker may be sent information that reveals the ColdFusion version number. Once the attacker has the version of ColdFusion being used, he can begin looking for specific attacks the version may be vulnerable to if not patched and secured properly.

Checks: C-63327r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Missing Template Handler" setting is not blank and that the template specified is a valid. If the "Missing Template Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Missing Template Handler" is set to /CFIDE/administrator/templates/missing_template_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/missing_template_error.cfm If the "Missing Template Handler" setting is not a valid file, this is a finding.

Fix: F-68443r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Specify a valid handler for missing templates and select the "Submit Changes" button.

b

The ColdFusion site-wide error handler must be valid.

SI-11 - Medium - CCI-001312 - V-62525 - SV-77015r1_rule

RMF Control

SI-11

Severity

M

CCI

Version

CF11-06-000217

Vuln IDs

V-62525

Rule IDs

SV-77015r1_rule

The structure and content of error messages need to be carefully considered by the organization and development team. Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. When the site-wide error handler is blank, information can be presented to an attacker that may expose the cause of exceptions. Having this information, the attacker can then begin attacking this error trying to get the server to fail and cause a DoS, expose PII, or gain access to server resources. A custom site-wide error handler should be created and used that discloses the same generic message to the user for all exceptions and the error must be logged so that the error can be investigated.

Checks: C-63329r1_chk

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. Validate that the "Site-wide Error Handler" setting is not blank and that the template specified is valid. If the "Site-wide Error Handler" parameter is blank, this is a finding. If a template is specified, validate that the template exist. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web server's document root is /opt/webserver/wwwroot and the "Site-wide Error Handler" is set to /CFIDE/administrator/templates/secure_profile_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/secure_profile_error.cfm If the "Site-wide Error Handler" setting is not a valid file, this is a finding.

Fix: F-68445r1_fix

Navigate to the "Settings" page under the "Server Settings" menu. Specify a custom and valid site-wide error handler and select the "Submit Changes" button.

c

ColdFusion must have Robust Exception Information disabled.

SI-11 - High - CCI-001312 - V-62527 - SV-77017r1_rule

RMF Control

SI-11

Severity

H

CCI

Version

CF11-06-000218

Vuln IDs

V-62527

Rule IDs

SV-77017r1_rule

Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. ColdFusion is a development and deployment framework. To handle this role properly, ColdFusion offers several debugging and logging facilities that must be disabled in a production environment. If left enabled, these settings can expose sensitive data within error and log messages.

Checks: C-63331r1_chk

Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Robust Exception Information" is checked, this is a finding.

Fix: F-68447r1_fix

Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Robust Exception Information" and select the "Submit Changes" button.

c

ColdFusion must have AJAX Debug Log Window disabled.

SI-11 - High - CCI-001312 - V-62529 - SV-77019r1_rule

RMF Control

SI-11

Severity

H

CCI

Version

CF11-06-000219

Vuln IDs

V-62529

Rule IDs

SV-77019r1_rule

Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. Allowing the AJAX Debug Log Window to be enabled allows a user to send AJAX debug messages back to a client. The log data sent is meant to be used in a development environment and used to fix errors in AJAX code. Once the application is developed and is moved to production, debugging is not needed and this feature must be disabled.

Checks: C-63333r1_chk

Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable AJAX Debug Log Window" is checked, this is a finding.

Fix: F-68449r1_fix

Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable AJAX Debug Log Window" and select the "Submit Changes" button.

c

ColdFusion must have Request Debugging Output disabled.

SI-11 - High - CCI-001312 - V-62531 - SV-77021r1_rule

RMF Control

SI-11

Severity

H

CCI

Version

CF11-06-000220

Vuln IDs

V-62531

Rule IDs

SV-77021r1_rule

Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages needs to be carefully considered by the organization and development team. The option to enable request debugging output is another tool that a developer can use during the development phase of the hosted application. This feature appends debugging information to the end of each CFML request. Once a hosted application is moved from the development phase to production, the need for debug information is no longer valid.

Checks: C-63335r1_chk

Within the Administrator Console, navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. If "Enable Request Debugging Output" is checked, this is a finding.

Fix: F-68451r1_fix

Navigate to the "Debug Output Settings" page under the "Debugging & Output Settings" menu. Uncheck "Enable Request Debugging Output" and select the "Submit Changes" button.

c

ColdFusion must have Allow Line Debugging disabled.

SI-11 - High - CCI-001312 - V-62533 - SV-77023r1_rule

RMF Control

SI-11

Severity

H

CCI