Q: Unauthorised access to coldfusion source cfm

Question

From the point of view, of security, how easy it for a visitor to a website to get access to the actual coldfusion source code, residing in the .cfm pages, that make up a website ?
Are there any good practices to follow to help safeguard things, perhaps using includes and placing sensitive source code in those, located outside the public folder on the webserver ?

Answer 1

Right, so a "visitor to the website" is not going to be able to see your code, on the whole, because visitors go in through the front door.  What you're asking is "how do I harden my website".
Things to watch out for:
* do not have debugging switched on;
* do not have robust exception handling switched on;
* only have files intended to be web browsed in directories that are web browseable.  On the whole, very few of your CFM files would / should fall into this category.  Someone else mentioned XML files.  In general the only XML files that should be web browseable should be things like RSS feeds.  Config files should not be web browseable.
* have a global error handler so that if any error DOES happen, the raw error message is not displayed.  Having an error "could not find variables.theSecretPassword" gives a person a clue as to what variable names they should be trying to hack. Just display "there was an error", and nothing else.
* clean all user input before writing it to the DB or outputting it on the screen (and that's URL variables, form variables, cookie values, and probably other things too).  Don't assume a post comes from your form.  It might not.  Even search forms input needs to be cleaned, even if it never gets stored: you're probably rendering it on the search results page, which means if there's JS in it, it'll execute as if it's come from your domain.
* tread with caution with file uploads.  I've been able to upload a file to a CMS which allowed me to bypass admin access to the management interface, which gave me full access to CF on that box.  because CF was running as an administrator, I had full access to the machine too.
* google "website security" and "website hardening" and read everything you can find.  This is not a trivial topic.
Adam