Title

The ColdFusion administrator must be using HTTPS to maintain the confidentiality and integrity of information during reception. (Cat II impact)

Discussion

Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. ColdFusion must use approved encryption when receiving transmitted data by configuring the Tomcat Connector to use HTTPS.

Check Content

Verify HTTPS. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol). If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding. If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

Fix Text

Configure ColdFusion to use HTTPS and disable unsecured HTTP access. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true" 4. Either delete these unsecured <Connector> tags or comment them out using XML syntax: <!-- <Connector port="8500" protocol="org.apache.coyote.http11.Http11Protocol" ... /> --> 5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication. 6. If this tag is present but commented out, uncomment it by removing the <!-- and --> markers. 7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes: <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/> 8. Replace /path/to/keystore with the actual path to the keystore file. 9. Replace "changeit" with the actual password for the keystore. 10. Save the file and restart ColdFusion for the changes to take effect.

Additional Identifiers

Rule ID: SV-279098r1172830_rule

Vulnerability ID: V-279098

Group Title: SRG-APP-000442-AS-000259

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.