ColdFusion Article

Use the following criteria to select a firewall solution:

• Implement firewalls that support proxy servers and/or "stateful inspection," rather than simple packet-filtering solutions.
• Use a firewall that supports a "deny all services except those explicitly permitted" security paradigm.
• Implement a firewall solution that is dual-homed or multihomed. This architecture provides the greatest level of security and helps to prevent unauthorized users from bypassing the security of the firewall.

Service vulnerabilities are used by attackers to compromise systems. The more services that are installed on the server, the more vulnerabilities that may be exploited.

IIS has the option to install WWW Service, IIS Admin, FTP, NNTP, and SMTP. FTP and NNTP should not be installed on a dedicated ColdFusion server. Also, if no application needs the ability to send and receive e-mail locally, SMTP should not be installed.

Download the Windows Server 2003 Security Guide. The guide includes three policy templates; one is the High Security template. Apply only the High Security template to the IIS server prior to installing ColdFusion.

After applying the template, you must modify the following settings to allow IIS to run properly:

Under User Rights Assignments:

• To allow anonymous users to connect to IIS, remove the Guests group from the "Deny access to this computer from the network" policy. The IUSR account is a member of the Guests group.

Under System Services:

• Set HTTP SSL service to Automatic. The HTTP SSL service enables IIS to perform Secure Sockets Layer (SSL) functions.
• Set IIS Admin Service to Automatic. The IIS Admin Service allows administration of IIS components such as File Transfer Protocol (FTP), Application Pools, websites, web service extensions, and Network News Transfer Protocol (NNTP) and Simple Mail Transfer Protocol (SMTP) virtual servers.
• Set World Wide Web Publishing Service to Automatic. The World Wide Web Publishing Service provides network connectivity and administration of websites.

For forensic analysis, keep accurate time on ColdFusion servers. Use NTP to synchronize the time on all systems that are connected directly to the Internet. Figure 1 shows how to configure Internet time in Windows Server 2003 to time.nist.gov.

Figure 1. Configuring Internet time in Windows Server 2003

The administrative CFIDE web application is installed by default and grants access to everyone. The only protection offered by the application is a password field. That means an attacker needs only to guess your password to gain administrative rights to your ColdFusion application server:

1. Log in to your computer using an account that is not in the Administrators group.

2. Use the Run As command to run IIS Manager as an administrator.

   To grant access to a computer:

3. In IIS Manager, expand the local computer, right-click a website, directory, or file, and select Properties.
4. Click the Directory Security or File Security tab. In the IP Address and Domain Name Restrictions section, click Edit.
5. Click Denied Access. When you select Denied Access, you deny access to all computers and domains, except those to which you specifically grant access.
6. Click Add.
7. Select Single Computer.
8. Type the IP address of your administrative host; localhost is recommended (127.0.0.1).

9. Click OK twice.

   To restrict access to an NT account:

10. In the Authentication and Access Control section, click Edit.
11. Deselect the Enable Anonymous Access option.

ColdFusion installs this account by default using the LocalSystem account. The built-in LocalSystem user account has a high level of accessibility; it is part of the Administrators group. If a worker process identity runs as the LocalSystem user account, that worker process has full access to the entire system.

To run the ColdFusion MX 7 application server using a specific non-administrative account, follow these instructions:

1. In the Computer Management MMC, create a local user for the ColdFusion service to log in as.

   1. Select the option"User cannot change password".
   2. Under the Member Of tab, ensure that the Users group is listed.
2. Select Start menu > Settings > Control Panel > Administrative Tools > Services.
3. Double-click the ColdFusion MX 7 Application Server service.
4. Stop the service.
5. Under the Log On tab, click the This Account option and browse to the user account you created. Enter the password for that account.

6. Give the user account that ColdFusion Server is running under the following rights. Under "User Rights Assignment" in the "Local Security Settings" MMC:

   1. Deny log on through Terminal Services.
   2. Deny log on locally.
   3. Log on as Service (should be already set).

7. Give the new user account "Read & Execute, List Folder Contents, and Read" permissions for the following items:

   1. ColdFusion web content directories (i.e. cfide or cfdocs)
   2. C:\cfusion or C:\cfusionmx (and all subdirectories)
8. Start the ColdFusion MX 7 application server service.

Enable the Use J2EE Session Variables option. ColdFusion provides two types of session management: its own proprietary means and through J2EE. J2EE sessions provide the following security and performance related features in ColdFusion:

• Session terminates when the user closes all browser windows.
• J2EE session management uses a session-specific session identifier, jsessionid, which is created at the start of each session.
• Share session variables between ColdFusion pages and JSP pages or Java servlets that you call from the ColdFusion pages. This could prevent you from having to store sensitive information in a cookie.

Disable the following AllowedSQL options for all data sources:

• Create
• Drop
• Grant
• Revoke
• Alter

As an administrator, you do not have control over what a developer sends to the database. However, there should be no circumstance where the previous commands need to be sent to an SQL server from a web application.

Restricting database queries to parameterized stored procedures or query strings (using the CFQUERYPARAM tag) can greatly reduce the risk of SQL injection attacks. For more information regarding CFQUERYPARAM and SQL injection, read Securing Database Access Using the cfqueryparam Tag by Dave Watts.

The ColdFusion sandbox allows you to place access security restrictions on files, directories, methods, and data sources. Sandboxes make the most sense for a hosting provider or corporate intranet where multiple applications share the same server. First, select this option.

Next, configure a sandbox. If you don't, all code in all directories can execute without restriction. Code in a directory and its subdirectories inherits the access controls defined for the sandbox. For example, if ABC company creates multiple applications within a directory, all applications have the same permissions as the parent. A sandbox applied to ABC-apps applies to app1 and app2. The following is a sample directory structure:

D:\inetpub\wwwroot\ABC-apps\app1
D:\inetpub\wwwroot\ABC-apps\app2

Note: If you create a new sandbox for app2, it does not inherit settings from ABC-apps.

Sandbox security configurations are application-specific; however, there are general guidelines to follow:

1. Create a default restricted sandbox and copy setting to each subsequent sandbox, removing restrictions as needed by the application, except in the case of files/directories where access is granted rather than restricted:

   • Restrict access to data sources that the sandboxed application should not have accessed to
   • Restrict access to powerful tags, for example CFREGISTRY and CFEXECUTE
2. Restrict file and directory access to limit the ability of tags and functions to perform actions to specified paths.
3. Give every application a sandbox.

For more information on sandbox security, see the ColdFusion LiveDocs.

In production environments, you should not use RDS. In earlier versions of ColdFusion, RDS ran as a separate service or process and could be disabled by disabling the service. In ColdFusion MX 7, RDS is integrated into the main service. To disable it, you must disable the RDSServlet mapping in the web.xml file. The following procedure assumes that ColdFusion is installed in the default location:

1. Back up C:\CFusionMX7\wwwroot\WEB-INF\web.xml.
2. Open web.xml for editing.

3. Comment out the RDSServlet mapping, as follows:

   <!—
   <servlet-mapping> 
   <servlet-name>RDSServlet</servlet-name> 
   <url-pattern>/CFIDE/main/ide.cfm</url-pattern> 
   </servlet-mapping>
   -->

4. Save the file.
5. Restart ColdFusion.