Allowing someone to upload a file on to your web server is a common requirement, but also a very risky operation. So here are some tips to help make this process more secure.
cffile accept attributeaccept attribute gives a terrible false sense of security. Every time I present on CFML Security I ask the question: If I have this code is there any way I could upload a CFM file?.<cffile action="upload"
filefield="photo"
accept="image/gif,image/jpeg"
destination="#ExpandPath("./photos/")#">
The answer is YES, often to the surprise of most!<cfhttp url="http://target.example.com/upload" method="post">
<cfhttpparam file="#ExpandPath("badstuff.cfm")#"
mimetype="image/gif"
type="file"
name="photo">
</cfhttp>
For this reason you need to ensure that cffile.serverFileExt is of an extension you allow, and one that your server will not execute.IsImageFile("path") and IsPDFFile("path") functions you could use. If you do use IsImageFile just make sure that you have upgraded your JVM to one that doesn't have the issue that can cause an image file to crash your server. See Mark Kruger's blog entry for details.
cfhttp but you now have code in place to delete the file if the extension is incorrect. There is a slight chance that I could execute that file before you can delete it if you uploaded it into the web root (and I could predict where it would be placed).cfcontent. In some cases this is not possible, but seriously consider this as it does ease the risk significantly.
LimitRequestBody directive to do this.
Summary
This article goes over securing CFIDE for ColdFusion against malicious uploads (http://www.adobe.com/support/security/advisories/apsa13-01.html) Update 1/16/2013: Adobe has issued a patch (http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html). Edge Web Hosting still recommends locking down ColdFusion below in addition to applying the patch. Update 5/15/2013: Due to recent changes in security on Edge's network, all CF Admin requests are locked down to internal connections only (i.e. from RDC or through an SSH Tunnel for Linux) Steps Note that if you are adding a new site to the server, you will need to follow the steps below for securing the CFIDE directory. For IIS7, please follow the steps below.
 
For IIS6, please follow the steps below.
 
For Apache, please follow the steps below.
<LocationMatch "/CFIDE/administrator/"> <LocationMatch "/CFIDE/componentutils"> |
http://localhost:8080/. If you changed the default port from 8080, use your custom port number instead. The list of variables shown in Figure 4 should display.
wwwroot. For a default installation on Windows, the document root is the folder C:\BlueDragon_Server_70\wwwroot. In this directory you’ll find a file calledindex.cfm. This is the file that was parsed by the BlueDragon server in order to produce the page in Figure 4.cf. This is CFML — the core language of ColdFusion. If you haven’t dealt with ColdFusion development before, this code may not make much sense to you, but fear not — we’ll walk through it now."CFEclipse" in the name field, and http://www.cfeclipse.org/update as the URL. Once you’ve done that, make sure that only the CFEclipse option is checked, then click Continue. Continue through with the rest of the installation process, restarting Eclipse when you’re done.-clean.File > New Project to bring up the new project wizard. As I’ve done in Figure 5 below, select CFML Project from the CFEclipse category.
wwwroot directory that we created during the BlueDragon installation.
+ next to the folder to expand the view, and locate the index.cfm file. Double-click the filename to edit it in Eclipse.index.cfm file contains a number of confusing tags; let’s delete the entire contents of this file and replace it with the following code:<html>
<head>
<title>BlueDragon CFML Test Page</title>
</head>
<body bgcolor=#FFFFFF>
<h1>BlueDragon CFML Test Page</H1>
<!-- Our code will go here -->
</body>
</html><cfset hello_world = "Hello World!">
<cfoutput>#hello_world#</cfoutput>http://localhost:8080/, and you should see a page that displays "BlueDragon CFML Test Page" in its title, and the words "Hello World!" in its body.
<cfset hello_world = "Hello World!">cfset tag is used to set variables. In this case, we’re creating a string that contains the value "Hello World," and can be identified by the name hello_world. In its most basic form, cfset syntax looks something like this:<cfset variable_name = value><cfoutput>#hello_world#</cfoutput>cfoutput tag accomplishes the same goal as functions such as print and echo in other languages — it writes output to the browser (which is why it’s called, erm, cfoutput). The # signs inside the tag let cfoutput know that the contents it contains are dynamic. You can place either a variable or the result of a function inside the # signs, and it will be evaluated and replaced with the dynamic content. You can also mix regular text with dynamic content, like this:<cfoutput>The variable hello_world = #hello_world#</cfoutput>The variable hello_world = Hello World!
