Security enhancements in ColdFusion (2016 release)

As shown in the following sample code, the attacker can create arbitrary SQL statements to execute against the database by passing values into the url.id variable. For example, the attacker can pass a value of 1 DELETE FROM news to delete all news articles in the table or 0 UNION SELECT username, password FROM users to extract username and password values from the database.

<cfquery>

SELECT headline, story

FROM news

WHERE id = #url.id#

</cfquery>

Vulnerable scenarios

• <cfquery name="SelectExample"

                datasource="cfdocexamples">

         select FROM Employee

         WHERE Emp_ID=#var#

      </cfquery>

• <cfset result = QueryExecute("select * from Employees where empid=#id5#")>

• <cfset v3="#form.vf#"><cfset employees = ORMExecuteQuery("from Employee where name=#v3#")>

All the above code samples use an unknown variable inside the query statement, which makes them vulnerable.

<cfoutput>Hello #url.name#</cfoutput>

Using the above code, the attacker can pass JavaScript into the url.name variable to be executed in the browser of anyone visiting the URL. Attackers also try to post XSS code that can be stored in a database and execute later. For example, posting a comment to display for all visitors of a page.

Vulnerable scenarios

• <cfoutput>Hello #name2#</cfoutput>
• <cfparam name = "id12" default = "my default value" type="string">
• <cfoutput>#id12#</cfoutput>
  When a variable declared through cfparam is of type “string”, it is vulnerable code.
• <cfoutput > <b>LINK to URL:</b> <a target="_blank" href="http://#url#">#url#</a> </cfoutput>
  As an unknown variable is used for the url link in the anchor tag, it is vulnerable to XSS attack.
  

The cfhtmltopdf tag, introduced in ColdFusion 11 provides powerful HTML rendering, powered by WebKit to produce PDF files. As the server renders the HTML, be cautious while using variables in the PDF document.

All preventative measures pertaining to cross site scripting also apply to variables written in the cfhtmltopdf tag. JavaScript can be executed during rendering, in the cfhtmltopdf tag.

Because the JavaScript would be executed on the server during rendering, the risks are different from a client side cross site scripting attack. Some of the risks include denial of service and potential exploit for unknown vulnerabilities in Webkit. In addition, there is a risk of bypassing the network firewall as the server can be behind a firewall with network access to other systems.

Vulnerable scenarios

• <cfhtmltopdf>

<h1>Hello <cfoutput>#pf2#</cfoutput></h1>

</cfhtmltopdf>

• <cfhtmltopdf>

 <h1>Hello <cfoutput>#url.name#</cfoutput></h1>

      </cfhtmltopdf>

• <cfdocument format="PDF">

            <cfoutput>   #hello#

            </cfoutput>

            <cfdocumentitem type="header" >

            <cfoutput>#abc#</cfoutput>     

            </cfdocumentitem>

      </cfdocument>

Cross Site Request Forgeries (CSRF) vulnerabilities are exploited when an attacker can trick an authenticated user into clicking a URL, or by embedding a URL in a page requested by a user’s authenticated browser.

Vulnerable scenarios

• <cfform method="POST">
     <cfinput type="submit" value="Make Administrator"/></cfform>

When CSRFGenerateToken() function is not used, the code is vulnerable.

• <cfform method="POST">
  <cfinput type="hidden" name="token" value="#CSRFGenerateToken()#" />
  <cfinput type="submit" value="Make Administrator" />
  </cfform>

When there is no corresponding CSRFVerifyToken () function for CSRFGenerateToken   
function, the code is vulnerable.

• <cfset var2 = CSRFGenerateToken2("make-admin")>

            <cfform method="POST"  action='/csrf/dummy.cfm'>

            <cfinput type="hidden" name="token" value="#var2#" />

            <cfinput type="submit" value="Make Administrator" />

            </cfform>

When there is no corresponding CSRFVerifyToken () function for CSRFGenerateToken
function  in the action page that is specified.

Avoid appending the session identifiers to the URL query string. End users email, or publish URLs without realizing their session identifier is in the url.

Vulnerable scenarios

• <cflocation url="random.cfm" addtoken="true">

When the attribute “addtoken” is explicitly set to true.

• <cflocation url="random.cfm">

When the “addtoken” is not specified, the default value of true is taken.

• <cfset  addtoken1 = "true">

      <cflocation url="random.cfm" addtoken="#addtoken1#">

When a variable is used by “addtoken” attribute, which is set to true.