Pete Freitag Pete Freitag

ScriptProtect in ColdFusion MX 7 not a catch all

coldfusion

ColdFusion MX 7 has a new feature that lets you "lets you protect one or more variable scopes from cross site scripting (XSS) attacks". It can be turned on in the cfapplication tag using the scriptProtect attribute, or in the ColdFusion Administrator as a global setting.

<cfapplication scriptProtect="all">

The feature is a set of regular expressions located in lib/neo-security.xml that replaces the tags: object, embed, script, applet, and meta with the tag name InvalidTag when they are passed as in put in the Form, URL, CGI, and Cookie scopes (you can pick which ones to check).

It recently came to my attention however that scriptProtect does not protect against all possible types of cross site scripting attacks, as you may have assumed.

You can for instance do a XSS attack with an iframe, so I felt that the feature gave a false sense of security, and I reported this to the Macromedia security team yesterday. I wanted to give them a chance to fix anything before made this public. I received a response today:

We've forwarded your input to the development team and they have logged a bug that they will consider fixing for future updates of ColdFusion. At the moment, we feel that the documentation provided is sufficient to let our customers know what the scriptprotect attribute does and does not protect against.

The scriptprotect attribute is meant to supplement to best-coding practices; it provides an easy way to filter out certain tag names, but is not meant to be a comprehensive solution against XSS attempts.

I didn't find the documentation to sufficiently explain what was stated in the second paragraph there, so I added it to the live docs. The customer needs to understand all types of cross site scripting attacks in order to deduce that the feature doesn't catch all cases.

You can pretty easily add iframe to the XSS regular expression, but you still won't be safe from all possible attacks.


Like this? Follow me ↯

ScriptProtect in ColdFusion MX 7 not a catch all was first published on May 17, 2005.

If you like reading about xss, security, scriptprotect, coldfusion 7, or cfapplication then you might also like:

FuseGuard Web App Firewall for ColdFusion

The FuseGuard Web Application Firewall for ColdFusion & CFML is a high performance, customizable engine that blocks various attacks against your ColdFusion applications.

Comments

This is a clear example of why black lists are a bad idea! Obviously it would be hard to implement a whitelist at the application server level, it belongs within the application itself. Unfortunately, most people will get a false sense of security from this.

Having not checked it out yet myself, I wonder if it manages canonicalization of the data to prevent users from entering data that is URLEncoded or encoded in an alternate characterset. Pete?

-dhs
by Dean H. Saxe on 05/17/2005 at 3:12:43 PM UTC
some time our site give this error
'ScriptProtect error replacing insecure tag'
this seems to ColdFusion bug. how can we get over it.
by M Bilal on 02/27/2008 at 1:29:41 AM UTC
I have also created a workaround for FCK in Ray Camdens blog.. This can be quite easily adapted to work in your own particular environment.

http://www.beetrootstreet.com/blog/index.cfm/2008/6/7/InvalidTag-encountered-in-web-pages-using-ColdFusion-due-to-cross-site-scripting-protection

Hope it helps

Martin
by ColdFusion developer on 06/12/2008 at 4:21:48 AM UTC