Securing Legacy CFML Code
1 like•371 views
The document discusses approaches for securing legacy CFML code, emphasizing the challenges of working with large, outdated codebases. It outlines methods for identifying and fixing vulnerabilities, including prioritizing high-risk areas such as file uploads and SQL injection. Additionally, it highlights the importance of effective version control, server updates, and server lockdown practices.
![USE BRACKET NOTATION
FIXING LEGACY EVALUATE EXAMPLE
<cfset day_1 = "Wednesday">
<cfset day_2 = "Thursday">
<cfset day_3 = "Friday">
<cfoutput>
#variables["day_#url.day#"]#
</cfoutput>](https://image.slidesharecdn.com/securing-legacy-cfml-2016-160623231855/85/Securing-Legacy-CFML-Code-22-320.jpg)
![SEARCH CODE FOR EVALUATE
FIXING EVALUATE ISSUES
• Search Code for "Evaluate"
• In most cases you should not need to use Evaluate at all, use
brackets.
• If the variable is a query you may need to use
queryName[row][columnName] notation.
• Not all cases are super simple to fix, but most are.
• Remove all Evaluate calls from your code.](https://image.slidesharecdn.com/securing-legacy-cfml-2016-160623231855/85/Securing-Legacy-CFML-Code-23-320.jpg)
Securing Legacy CFML Code
- 1. SECURING LEGACY CFML PETE FREITAG, FOUNDEO INC. foundeo
- 2. ABOUT PETE • My Company: Foundeo Inc. • Consulting: Code Reviews, Server Reviews, Development • FuseGuard: Web App Firewall for CFML • HackMyCF: Server Security Scanner • Blog (petefreitag.com), Twitter (@pfreitag), #CFML Slack • Guy behind cfdocs.org community sourced CFML docs.
- 3. AGENDA • Legacy Code Challenges • How do you get started? • Low Hanging Fruit • Things to focus on • What’s Next? • Disclaimer: This approach may not be appropriate for all scenarios. This is a generalized approach which I have found can work well for many.
- 4. LEGACY CODE? DO YOU HAVE TO WORK WITH
- 5. TYPICALLY LEGACY CODE • Has a large codebase (thousands of source code files) • Has code you hope you don't have to see again. • Can take weeks, but often months of work to properly secure. • Can be hard to fix, brittle • Probably uses outdated techniques
- 6. FIXING A LARGE CODEBASE HOW TO APPROACH • Beast Mode - Spend several weeks dedicated to identifying & fixing vulnerabilities. • Prioritize - Spend time identifying the most critical vulnerabilities and patch less critical vulnerabilities as you see them. • As you go - As you work on files fix vulnerabilities as you see them. You may not ever fix some vulnerabilities with this approach.
- 7. SECURING THAT LEGACY CODE HOW DO YOU START? STEP 1: DELETE THE CODE!
- 8. LEGACY CODEBASES ARE LARGE BUT… MUCH OF THE CODE PROBABLY NEVER RUNS
- 9. HOMEMADE VERSION CONTROL YOU MIGHT BE USING… • index_2.cfm • index.old.cfm • index-backup.cfm • index-2007-03-04.cfm • index-copy.cfm • folder_backup2009/
- 10. VERSION CONTROL • Those backup folders and files are probably full of vulnerabilities. • Version Control Server keeps backups of all your code and all changes you have ever made to it. • Sync server source code with version control. • Identify if someone changed something on the server.
- 11. IDENTIFY UNUSED CODE VERSION CONTROL • Spend some time to identify unused code. • Delete it! • Version control has your back, if you deleted something you can recover it from the repository.
- 12. THERE ARE LOTS OF FADS IN SOFTWARE DEVELOPMENT, VERSION CONTROL IS NOT ONE OF THEM. ” “
- 13. WELCOME TO THE 90’S PATCH THAT SERVER • Use ColdFusion 10 or greater (CF9 and below are no longer supported and no longer patched by Adobe). • Railo has not been touched since 2014, use Lucee (it is very easy to switch). • Windows 2008 (EOL 2015) • Java 8+, Java 7 (EOL 2015), Java 6 (EOL 2013)
- 14. FIX VULNERABILITIES PATCH THAT SERVER • Multiple Denial of Service Vulnerabilities in old versions of Java • Path Traversal via Null Byte injection JVM • CRLF Injection (CF10+) • File Uploads “somewhat” more secure (CF10+) • TLS / SSL Protocol Implementations • Java 8 Not supported on CF9 and below
- 15. MITIGATES POTENTIAL IMPACT OF A VULNERABILITY LOCKDOWN THE SERVER • If your CFML server is running as SYSTEM or root then the attacker can do a lot more harm. • If CFML server user has read only access to web root.
- 16. WEB APPLICATION FIREWALLS IMPLEMENT A WAF • Inspect HTTP Request or Response • Block or log malicious requests • Several options • Hardware • Web Server Level - ModSecurity • Application Level - FuseGuard
- 17. SECURING THAT LEGACY CFML? HOW DO YOU START STEP 2: IDENTIFY HIGH RISK VULNERABILITIES IN YOUR CODE.
- 18. TAKE CARE OF THESE FIRST HIGH RISK VULNERABILITIES • File Uploads • Dynamic Evaluation Issues • SQL Queries (SQL Injection) • File System Access / Path Traversals • Dynamic Process Execution (CFEXECUTE) • Anything that can fully compromise server
- 19. EVALUATE REMOTE CODE EXECUTION VIA
- 20. CODE EXAMPLE COMMON LEGACY EVALUATE <cfset day_1 = "Wednesday"> <cfset day_2 = "Thursday"> <cfset day_3 = "Friday"> <cfoutput> #Evaluate("day_#url.day#")# </cfoutput>
- 21. EVALUATE EXAMPLE
- 22. USE BRACKET NOTATION FIXING LEGACY EVALUATE EXAMPLE <cfset day_1 = "Wednesday"> <cfset day_2 = "Thursday"> <cfset day_3 = "Friday"> <cfoutput> #variables["day_#url.day#"]# </cfoutput>
- 23. SEARCH CODE FOR EVALUATE FIXING EVALUATE ISSUES • Search Code for "Evaluate" • In most cases you should not need to use Evaluate at all, use brackets. • If the variable is a query you may need to use queryName[row][columnName] notation. • Not all cases are super simple to fix, but most are. • Remove all Evaluate calls from your code.
- 24. DO ANY OTHER FUNCTIONS EVALUATE DYNAMICALLY?
- 25. IF YOU ARE USING IIF STOP USING IIF IIF Hi #iif(len(url.name) EQ 0, de("Friend"), de(url.name))# The second and third arguments are evaluated dynamically!
- 26. IIF EXAMPLE
- 27. USE TERNARY OPERATOR (CF9+, LUCEE) FIXING IIF Hi #(!len(url.name)) ? "Friend" : url.name# Hi #url.name?:"Friend"# ELVIS OPERATOR (CF11+, LUCEE) Elvis Operator tests to see if url.name is defined / not null
- 28. DO ANY OTHER FUNCTIONS EVALUATE DYNAMICALLY?
- 29. YES! The PrecisionEvaluate function also dynamically evaluates expressions
- 30. DO ANY OTHER FUNCTIONS EVALUATE DYNAMICALLY?
- 31. YES! Lucee 5 has added a render function that evaluates tags dynamically.
- 32. DO ANY OTHER FUNCTIONS EVALUATE DYNAMICALLY?
- 33. NO! Not that I know of
- 34. FILE UPLOADS COMMON YET DANGEROUS
- 36. 3 RULES FILE UPLOADS • The upload destination must be outside of the web root • Always validate the file extension against a whitelist • Don't trust mime type validation in the accept attribute
- 37. ADDITIONAL TIPS FILE UPLOADS • Inspect file content: fileGetMimeType, isImageFile, isPDFFile, etc • Upload to static content server (s3 for example) • Upload directly to s3: https://www.petefreitag.com/item/ 833.cfm • Make sure directory serving uploaded files cannot serve dynamic content. • File Extension Whitelist on Web Server (eg IIS Request Filtering) • secureupload.cfc: https://github.com/foundeo/cfml-security/
- 38. PATH TRAVERSAL FILE SYSTEM ACCESS &
- 39. VULNERABLE CODE EXAMPLE PATH TRAVERSAL <cfinclude template="path/#fileName#">
- 41. TIPS FIXING PATH TRAVERSALS • Avoid variables in paths • If you really need to use a variable strip out everything except a-z0-9 • Use the CF11 Application.cfc setting this.compileExtForInclude setting.
- 42. CAN BE TIME CONSUMING FINDING FILE ACCESS ISSUES • Review all function calls / tags that access file system • cffile, cfdocument, cfinclude, cfmodule, cfspreadsheet • fileRead, fileWrite, fileOpen, etc
- 43. SQL INJECTION
- 44. CODE EXAMPLE CLASSIC SQL INJECTION <cfquery> SELECT title, story FROM news WHERE id = #url.id# </cfquery>
- 45. CODE EXAMPLE FIXING SQL INJECTION <cfquery> SELECT title, story FROM news WHERE id = <cfqueryparam value="#url.id#"> </cfquery>
- 46. SQL INJECTION SCRIPT BASED queryExecute("SELECT story FROM news WHERE id = :id", {id=url.id}); queryExecute("SELECT story FROM news WHERE id = #url.id#"); Vulnerable Not Vulnerable
- 47. DONEC QUIS NUNC FINDING SQL INJECTION • Search codebase for cfquery, queryExecute, ormExecute query • Use Static Code Analyzer (CFBuilder 2016) • Fix when you see one as you work
- 48. SECURING LEGACY CFML STEP 3: FIX ADDITIONAL VULNERABILITIES IN YOUR CODE.
- 49. TO REVIEW WHAT'S NEXT • Session Handling (sessionRotate, sessionInvalidate) • Scope Injection • Authentication / Authorization / Forgot / Remember Me Code • Cross Site Scripting • Cross Site Request Forgery • Timing Attacks • Visit OWASP.org for tons of info about web application vulnerabilities
- 50. THANK YOU Questions? Pete Freitag [email protected] foundeo.com | fuseguard.com | hackmycf.com foundeo