ColdFusion Lockdown Series - Multiple Partitions
One of the most frequent questions I get about the Adobe ColdFusion 9 Lockdown Whitepaper is:
Why do you suggest using 3 partitions when installing ColdFusion?
First lets get out of the way what the partitions are for:
- Operating System (typically the C:\ drive or partition)
- ColdFusion Installation
- Your Web Root (eg your CFM files)
How does this make my ColdFusion server more secure?
Consider a directory traversal vulnerability, here's what one looks like in CFML:
Now I can make a request like this:
exploit.cfm?file=../../config.xml the contents of that file will be output as long as ColdFusion has permission to read it.
If I installed everything on the same drive (eg c:\) this exploit is a whole lot more dangerous because the hacker can read any file on the server that ColdFusion has access to. With separate partitions you are limited to reading files on the same drive letter.
A few things to note:
- A directory traversal exploit could and has existed in web servers and within ColdFusion administrator (make sure you are all patched up, and give HackMyCF a try). So your code is not the only place such an exploit could take place.
- The more drives the better, 3 is a minimum, you can also create additional partitions for logs, or other apps.
- This advantage is fairly specific to Windows servers (since everything falls under
/on UNIX), but there may be other advantages to having multiple partitions as well.
- CFSummit 2016 Slides - October 17, 2016
- Fixinator and Foundeo Security Bundle - May 14, 2019
- Scope Injection in CFML - March 3, 2015
- New HackMyCF Features - October 24, 2013
- J2EE Sessions in CF10 Uses Secure Cookies - April 5, 2013
- What is the difference between ASCII Chr(10) and Chr(13)
- Fixinator and Foundeo Security Bundle
- Running CFML on AWS Lambda with FuseLess Slides
- Updating Java on ColdFusion or Lucee
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token