Rash of Attacks Target Coldfusion

In the last few days there have been a rash of attacks seemly targeted at Coldfusion. More specifically older Coldfusion applications/sites that do not make use of parameterized queries

using cfqueryparam and/or properly sanitize incoming url parameters.

The classic example being:

The above code snippet is particularly vulnerable to sql-injection.

The attack making it's rounds injects a SQL script that once executed goes through the sysobject system table looking for all varchar columns in every single table in the database.

It then loops through all the columns and appends Javascript script pointing to a Javscript file on a Chinese domain (I was unable to access the js file to see what it contained, the site was unreachable when I tried).

The first thing to do to protect yourself from this type of attack is to use the cfqueryparam tag especially for queries that make use of url or form variables.

The above query using cfqueryparam would look like:

Secondly be smart about your datasources, create a specific database user for your application that restricts access to only those rights that it specifically needs to do it's job. Giving every Coldfusion Datasource admin rights is asking for trouble.

Thirdly don't give your potential hacker any information about your server. Catch all errors using a site wide error handler and display a generic error message. At the least turn off detailed debugging on your production server.

It might be time to look again at some of those old applications you wrote years ago and check that you aren't vulnerable.

Happy Coding...