ScriptProtect in ColdFusion MX 7 not a catch all

May 17, 2005

ColdFusion MX 7 has a new feature that lets you "lets you protect one or more variable scopes from cross site scripting (XSS) attacks". It can be turned on in the cfapplication tag using the scriptProtect attribute, or in the ColdFusion Administrator as a global setting.

<cfapplication scriptProtect="all">

The feature is a set of regular expressions located in lib/neo-security.xml that replaces the tags: object, embed, script, applet, and meta with the tag name InvalidTag when they are passed as in put in the Form, URL, CGI, and Cookie scopes (you can pick which ones to check).

It recently came to my attention however that scriptProtect does not protect against all possible types of cross site scripting attacks, as you may have assumed.

You can for instance do a XSS attack with an iframe, so I felt that the feature gave a false sense of security, and I reported this to the Macromedia security team yesterday. I wanted to give them a chance to fix anything before made this public. I received a response today:

We've forwarded your input to the development team and they have logged a bug that they will consider fixing for future updates of ColdFusion. At the moment, we feel that the documentation provided is sufficient to let our customers know what the scriptprotect attribute does and does not protect against.

The scriptprotect attribute is meant to supplement to best-coding practices; it provides an easy way to filter out certain tag names, but is not meant to be a comprehensive solution against XSS attempts.

I didn't find the documentation to sufficiently explain what was stated in the second paragraph there, so I added it to the live docs. The customer needs to understand all types of cross site scripting attacks in order to deduce that the feature doesn't catch all cases.

You can pretty easily add iframe to the XSS regular expression, but you still won't be safe from all possible attacks.

Related Entries

3 people found this page useful, what do you think?


This is a clear example of why black lists are a bad idea! Obviously it would be hard to implement a whitelist at the application server level, it belongs within the application itself. Unfortunately, most people will get a false sense of security from this. Having not checked it out yet myself, I wonder if it manages canonicalization of the data to prevent users from entering data that is URLEncoded or encoded in an alternate characterset. Pete? -dhs
It's funny, becase there are many XSS holes on the site itself. Maybe they should enable that attribute themselves! haha.
Hi guys, I've been trying to add flash videos to my site but I keep getting the <invalidtag> thing. so i added this to my application.cfm. scriptprotect="script,applet,meta" now the flash files play, but so do scripts and meta refresh tests. Have I done the scriptprotect thing right? I only want <object> and <embed> tags to work. thanks chris
some time our site give this error 'ScriptProtect error replacing insecure tag' this seems to ColdFusion bug. how can we get over it.
I have also created a workaround for FCK in Ray Camdens blog.. This can be quite easily adapted to work in your own particular environment. Hope it helps Martin

Post a Comment


Spell Checker by Foundeo

Recent Entries


did you hack my cf?