ColdFusion Lockdown Series - Multiple Partitions
One of the most frequent questions I get about the Adobe ColdFusion 9 Lockdown Whitepaper is:
Why do you suggest using 3 partitions when installing ColdFusion?
First lets get out of the way what the partitions are for:
- Operating System (typically the C:\ drive or partition)
- ColdFusion Installation
- Your Web Root (eg your CFM files)
How does this make my ColdFusion server more secure?
Consider a directory traversal vulnerability, here's what one looks like in CFML:
Now I can make a request like this:
exploit.cfm?file=../../config.xml the contents of that file will be output as long as ColdFusion has permission to read it.
If I installed everything on the same drive (eg c:\) this exploit is a whole lot more dangerous because the hacker can read any file on the server that ColdFusion has access to. With separate partitions you are limited to reading files on the same drive letter.
A few things to note:
- A directory traversal exploit could and has existed in web servers and within ColdFusion administrator (make sure you are all patched up, and give HackMyCF a try). So your code is not the only place such an exploit could take place.
- The more drives the better, 3 is a minimum, you can also create additional partitions for logs, or other apps.
- This advantage is fairly specific to Windows servers (since everything falls under
/on UNIX), but there may be other advantages to having multiple partitions as well.
- CFSummit 2016 Slides - October 17, 2016
- Fixinator and Foundeo Security Bundle - May 14, 2019
- Scope Injection in CFML - March 3, 2015
- New HackMyCF Features - October 24, 2013
- J2EE Sessions in CF10 Uses Secure Cookies - April 5, 2013
- Travis CI Error when installing oraclejdk8
- Tuning Tomcat IIS Connectors worker.properties and server.xml
- Push Tomcat logs with the AWS CloudWatch Logs Agent
- Sending nginx access logs to CloudWatch Logs Agent
- Setup CloudWatch Logs Agent on Ubuntu 18.04 LTS
- Tomcat Virtual Directory Howto
- Communications link failure MySQL JDBC with TLS
- Redirect www and non https in IIS using web.config