Apache and the ColdFusion Administrator

Posted At : November 10, 2006 8:10 PM | Posted By : Lucas
Related Categories: Apache, ColdFusion

We have been doing a bit on an audit of things over the last few days and we came across something that shocked us. Somewhere between CF and Apache, our ColdFusion administrator was accessible on our servers.

Now we all know that you should never have your CF admin pages visible to the general internet, you should always have them tucked away. We did! Or should I say, we thought we did. Turns out that you could still browse to the right URL and CF would render the admin for you.

There were no mappings or aliases, Apache would just see the .cfm pass the request to CF and it would just render it. Bit of a pain but nothing a quick change to the apache config wouldn't fix.

<Location "/CFIDE/Administrator)>
Order Allow,Deny
Deny from all
AllowOverride None
</Location>
That should to it right? we no, actually... it doesn't. It turns out that our silly case insensitive OS was still letting it through. A bit of hunting and a bit of playing with RegEx brought us this little gem.

<LocationMatch "((?i)/cfide/administrator)>
Order Allow,Deny
Deny from all
AllowOverride None
</LocationMatch>
It looks very similar to the first one except for the regular expression that tells apache to ignore case and match this string.

Now, our apache server returns a nice big fat...

Forbidden

You don't have permission to access /cfide/administrator on this server.

now doesn't that look better?

Comments (11) | Print | del.icio.us | Linking Blogs | 3078 Views

Related Blog Entries

Comments
[Add Comment]
Mark Lynch's Gravatar Nice find Lucas.

This is caused by the /CFIDE mapping that is hardcoded into ColdFusion. When apache see's the .cfm it passes the file to CF which has a mapping for /CFIDE and hence renders the admin.

All of the graphics will be missing but the functionality will still be there.

Cheers,
Mark
# Posted By Mark Lynch | 11/11/06 12:09 AM
Lucas Sherwood's Gravatar yeah, bit of a painful find thought - it is amazing how many sites have missed it thought :(
# Posted By Lucas Sherwood | 11/11/06 9:06 AM
jack's Gravatar We have been doing a bit on an audit of things over the last few days and we came across something that shocked us. Somewhere between CF and Apache, our ColdFusion administrator was accessible on our servers.

Now we all know that you http://www.batteryfast.com/toshiba/satellite-l100.... toshiba satellite l100 battery,
http://www.batteryfast.com/toshiba/satellite-l15.h... toshiba satellite l15 battery,
http://www.batteryfast.com/toshiba/pa3451u.htm toshiba pa3451u battery,
http://www.batteryfast.com/toshiba/pa3457u.htm toshiba pa3457u battery,
http://www.batteryfast.com/toshiba/satellite-a80.h... toshiba satellite a80 battery,
http://www.batteryfast.com/toshiba/satellite-a85.h... toshiba satellite a85 battery,
http://www.batteryfast.com/toshiba/pa3383u.htm toshiba pa3383u battery,
http://www.batteryfast.com/toshiba/pa3383.htm toshiba pa3383 battery,
http://www.batteryfast.com/toshiba/p30.htm toshiba p30 battery,

http://www.batteryfast.com/toshiba/a70.htm toshiba a70 battery,
http://www.batteryfast.com/toshiba/satellite-a70.h... toshiba satellite a70 battery,
http://www.batteryfast.com/toshiba/satellite-a75.h... toshiba satellite a75 battery,
http://www.batteryfast.com/toshiba/satellite-p30.h... toshiba satellite p30 battery,
http://www.batteryfast.com/toshiba/satellite-p35.h... toshiba satellite p35 battery,
http://www.batteryfast.com/toshiba/pa3431u.htm toshiba pa3431u battery,
http://www.batteryfast.com/toshiba/satellite-m60.h... toshiba satellite m60 battery,
http://www.batteryfast.com/toshiba/satellite-m65.h... toshiba satellite m65 battery,
http://www.batteryfast.com/clevo/m540.htm clevo m540 battery,

http://www.batteryfast.com/clevo/m375.htm clevo m375 battery,
http://www.batteryfast.com/clevo/m360.htm clevo m360 battery,
http://www.batteryfast.com/clevo/dr202.htm clevo dr202 battery,
http://www.batteryfast.com/clevo/me202bb.htm clevo me202bb battery,
http://www.batteryfast.com/fujitsu/fpcbp64.htm fujitsu fpcbp64 battery,
http://www.batteryfast.com/fujitsu/s2000.htm fujitsu s2000 battery,
http://www.batteryfast.com/fujitsu/fu-cbp109.htm fujitsu fu-cbp109 battery,
http://www.batteryfast.com/fujitsu/s7011.htm fujitsu s7011 battery,
http://www.batteryfast.com/fujitsu/fpcbp49.htm fujitsu fpcbp49 battery,
should never have your CF admin pages visible to the general internet, you should always have them tucked away. We did! Or should I say, we thought we did. Turns out that you could still browse to the right URL and CF would render the admin for you.
# Posted By jack | 9/28/08 2:31 PM
warhammer gold's Gravatar Comments: Apache and the ColdFusion Administrator
# Posted By warhammer gold | 10/9/08 7:05 PM
pacman's Gravatar pacman http://pacman.phreesite.com
# Posted By pacman | 10/24/08 11:34 PM
Cheap's Gravatar Buy Cheap Drugs http://www.24onlinedrug.com
# Posted By Cheap | 10/24/08 11:35 PM
warhammer gold's Gravatar <A href="http://www.vipwarhammergold.com/" target=_blank><FONT =4><B>warhammer gold</B></FONT></A> <FONT =4></FONT><A href="http://www.vipwarhammergold.com/news/news.html" target=_blank><FONT size=4><B>buy warhammer gold</B></FONT></A><BR><A href="http://www.bestwarhammer.com/" target=_blank><FONT size=4><B>warhammer gold</B></FONT></A><FONT size=4></FONT> <A href="http://www.bestwarhammer.com/news/news.html" target=_blank><FONT size=4><B>buy warhammer gold</B></FONT></A><BR><A href="http://www.aocsale.com/" target=_blank><FONT size=4><B>aoc gold</B></FONT></A> <FONT size=4></FONT><A href="http://www.aocsale.com/aoc-news/" target="_blank">http://www.aocsale.com/aoc-news/" target=_blank><FONT size=4><B>age of conan gold</B></FONT></A><BR><A href="http://www.game4power.com/" target=_blank><FONT size=4><B>wow gold</B></FONT></A> <FONT size=4></FONT><A href="http://www.game4power.com/news/" target="_blank">http://www.game4power.com/news/" target=_blank><FONT size=4><B>buy wow gold</B></FONT></A><BR><A href="http://www.wowgoldone.com/" target=_blank><FONT size=4><B>wow gold</B></FONT></A> <FONT size=4></FONT><A href="http://www.wowgoldone.com/" target=_blank><FONT size=4><B>buy wow gold</B></FONT></A><BR><A href="http://www.game4power.com/" target=_blank><FONT size=4><B>world of warcraft gold</B></FONT></A> <FONT size=4></FONT><A href="http://www.wowgoldone.com/" target=_blank><FONT size=4><B>world of warcraft gold</B></FONT></A><BR><A href="http://www.gamelevelup.com/" target=_blank><FONT size=4><B>wow power leveling</B></FONT></A><BR><A href="http://itemstores.com/" target=_blank><FONT size=4><B>wow item</B></FONT></A>
# Posted By warhammer gold | 11/19/08 6:06 PM
[Add Comment]