Plugging a CF and IIS Security Hole

[DarkMan]

Thanks to member Nero for this tip:

There is a hole in IIS that will allow people to see your ColdFusion source code by typing in a url like:
[ignore]

http://www.mysite.com/anypage.cfm+.htr

[/ignore]
If you're running CF, try it. You may be alarmed at what you see....

Anyways, there is a hotfix for this at:

http://www.microsoft.com/ntserver/nts/downloads/critical/q267559/default.asp

[sig]<p>Doug Trocino<br><a href=mailto:dtrocino@tecumsehgroup.com>dtrocino@tecumsehgroup.com</a><br><a href=

http://www.tek-tips.com>Tek-Tips

Forums</a><br>Technical Director<br>
Tecumseh Group, Inc.<br>
Sponsors of Tek-Tips Forums<br>
[/sig]

 

[Guest_imported]

I am worried that this bug is occuring on our site but had no like with the example url.

So all they have to do is type +.htr at the end.

http://www.mysite.com/anypage.cfm+.htr

 

[onirike]

Oh shoot... ;-(

That doesnt really give the exact code here but that really give too much...

I'll have to tell my server admin to fix this...

Thx a lot for the information,
Chris [sig][/sig]

 

[DarkMan]

If you type in the url to your .cfm page and you see a bunch of garble, plus your CF variable names and such, you need to download the HotFix. If you try it and get an error message saying &quot;Page Cannot Be Displayed&quot;, the HotFix is already in place...;-)

Good Luck,
Doug [sig]<p>Doug Trocino<br><a href=mailto:dtrocino@tecumsehgroup.com>dtrocino@tecumsehgroup.com</a><br><a href=

http://www.tek-tips.com>Tek-Tips

Forums</a><br>Technical Director<br>
Tecumseh Group, Inc.<br>
Sponsors of Tek-Tips Forums<br>
[/sig]

 

[tkl]

This reminds me of some basic security tips:

[ul][li]If you dont need it, remove it - ie if you have no ASP-scripts on your server then remove the corresponding application mappings, likewise for the htr-mapping[/li]

[li]Encrypt your CF-Templates. In \CFUSION\BIN is the cfencode.exe-utility. Using it an intruder will only see some garbage - never your source code[/li][/ul]

..my 2c

Thomas Klaeger
tkl@telenet.ch [sig][/sig]

 

[jcrawford32]

If you use the cfencode.exe utility can you still edit that code or do you have to work from an orginal copy? [sig][/sig]