ColdFusion Application Security: The Next Step Jason Dean Boston ColdFusion User Group September 16 th, 2009

Web Application Developer with the Minnesota Department of Health (MDH)‏ User Group Manager of the MDH CFUG Web Development Blogger ( Veteran of the U.S. Coast Guard Who I am

The Next Steps Request Forgeries Password Security Cookie Misuse/Exploits Session Management

Request Forgeries Hackers writing checks for your users to cash

That was confusing EXAMPLE deletePage.cfm?pageid=#pageID#

Request Forgeries Kay Bob Heh. The website is down!!! ??? Brrrriiiiiiinnnng Brrriiiinnnng Brrrrrriiinnng

Request Forgeries So What Happened?

Request Forgeries Kay Bob muwhahaha hackerForm.post();

So what can we do about it? The receiving action page/method probably:  Receives the request  Checks to make sure the user is authorized  Confirms that the ID is valid  Performs the action

How do we fix it?

How do we fix it? <cfif NOT StructKeyExists(form, "CSRFToken") OR NOT StructkeyExists(session.deleteForm, "CSRFToken") OR NOT StructkeyExists(session.deleteForm, "tokenExpires") OR NOT IsDate(session.deleteForm.tokenExpires) OR NOT session.deleteForm.CSRFToken EQ form.CSRFToken OR NOT DateDiff("s",Now(),session.deleteForm.tokenExpires) GT 0> Action Page/Method

Request Forgeries Question?

Password Security

Achieving a Secure Password Not Username Change Regularly Minimum Length Special Characters AlphaNumericLowercaseUppercase Not a Date Password1!

Password Security Right for the Site

Password Hashing What is it? Why Do it?

Hashing Example #hash1# #hash2# #hash3#

Hashing Example 472D46CB829018F9DBD65FB8479A49BB C2AF2111FF9C02C4EEE016CBCDF0D033 21AB8E7B12BA1793AB A5CD

Stronger Hashing Example In our previous example we had: Now let's add:

MD5 Result 472D46CB829018F9DBD65FB8479A49BB CBD672C9AAF85A22968C7BCF9FF90EED 10F1C46CAF873486E530570E7A298BBB

SHA-256 Result 7FA8A6E9FDE2F4E1DFE6FB029AF47C9633D4B7A616A42C3B2889C5226A 20238D ECB12086B0B57E445BED6C67EF6EB6C4F5A F9EF76E3E CA7EEBEE13499DB9C C7E3B63C5F76F1B0A16DE18DDA7 E7704E

SHA-512 Result 27166A235CD42FB7E5A45CB89F DCDC779E1697DB D4D05537E63FD3815B596511C8704C50791C7BA3C504CAB516E62 2BDC6EC09C9 8C205EA4105BE9D89D44E84B4D00BCD52A FEE63D99300AB4B2 3F2C30B77D6F7FD64D1B902F9BE85373D EA58EDA174AD4589 2FDE0A56F0EF04 791FEDFCA713F52A42DDA F5D8F5BC85953F385DF8D7835A7B32 FBFD16047C213883D46DC0834DB7A6F2549EAF7AB8CF264C8A6C9082 A2D0B5A420FFD

Hashing Question?

Password Salting Because users make stupid passwords

Salting Example Value 1 Hashed: #hash1# Value 2 Hashed: #hash2# Value 1 Salted and Hashed: #hash1Salted# Value 2 Salted and Hashed: #hash2Salted#

Salting Example Output Value 1 Hashed: 2AC9CB7DC02B3C0083EB70898E549B63 Value 2 Hashed: 2AC9CB7DC02B3C0083EB70898E549B63 Value 1 Salted and Hashed: BAD4613B67109FD512580E3E Value 2 Salted and Hashed: 3BB315CF3BA C79832C939098

Password Hashing and Salting Question?

Session Management

What is a session? HTTP/ OK index.cfm GET index.cfm HTTP/1.1 SessionID=3 SessionID=1 SessionID=2 Cookie: SessionID=3 Cookie: SessionID=1 Cookie: SessionID=2 Set-Cookie: SessionID=1 Cookie: SessionID=1 sessionid=0a30b0926a39d5d c552e387712

Session Token Types ColdFusion CFID & CFTOKEN Weak by default Can be made strong Persistent by default Can be set Session-Only Easier to manipulate token cookies Cannot be invalidated JEE JSESSIONID Strong by Default Session-Only by default Can be shared with JEE applications Can be invalidated

Session Persistence Sessions can be persisted in 3 ways In the URL String – In POST request In a Cookie

Manipulating CF Token Cookies In Application.cfc: <cfheader name="Set-Cookie" value="CFID=#session.CFID#;secure=true;HTTPOnly" /> <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;secure=true;HTTPOnly" />

Manipulating JEE Token Cookies In Application.cfc: header = "jsessionid" & "=" & session.sessionid & ";domain=" & domain & ";path=" & path & ";" & secure & ";" & HTTPOnly; response.addHeader("Set-Cookie", header);

Session Logout (ColdFusion) In UserService.cfc: In Application.cfc:

Session Logout (J2EE) In UserService.cfc:

Session Management Question?

Cookie Security

Cookie Parameters Name Value Expires Path Domain Secure HTTPOnly

Cookie Domain and Path 12robots.awesomebloggers.com domain=”.awesomebloggers.com” hacker.awesomebloggers.com domain=”.12robots.awesomebloggers.com” Path=”/” path=”/12robots”

Setting the HTTPOnly Flag

Questions? Please ask your questions now Comments? Jason Dean