What changed in Adobe ColdFusion STIG V1R3V1R3 changes

Discussion

Application servers provide a wide range of features and services, many of which may not be necessary or secure for a production DODDoW environment. One such feature is the ColdFusion WebSocket Service, which supports real-time, bidirectional communication for applications such as dashboards, online gaming, social networking, and live data feeds. This service communicates over HTTP or HTTPS using a proxy or the built-in WebSocket server. When enabled, the WebSocket Service consumes system resources and may introduce security risks if not properly configured or if left unused. These risks include unauthorized access, input injection, session hijacking, and the ability to bypass traditional security controls such as firewalls and proxies. If the WebSocket service is not actively required by hosted applications, it should be disabled to free up system resources and reduce the overall attack surface. When used, the WebSocket service must be securely configured. Satisfies: SRG-APP-000141-AS-000095, SRG-APP-000172-AS-000120, SRG-APP-000435-AS-000163, SRG-APP-000442-AS-000259

V-279040 in V1R3

Discussion

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DODDoW system. Event Gateway Services are used to pass events from external sources to ColdFusion components that are specified. Since this gateway is accepting events from external sources, a listener must be present. When enabled, along with the listener, memory, queues, and processes are available for gateway processes. These resources can be used by an attacker and should be disabled if the feature is not being used for hosted applications.

V-279041 in V1R3

Discussion

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DODDoW system. RDS is used in a development environment to allow authenticated users access to the server using special features within code editors like Dreamweaver, HomeSite+, ColdFusion Studio, Eclipse, and VSCode to obtain information from the server. For example, developers can determine what data sources exist, query them, build code based on them, and more. RDS also enables access from within the editors to files on the server (even remotely) over HTTP, as an alternative to FTP. This feature is not meant for production environments.

V-279042 in V1R3

Discussion

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DODDoW system. ColdFusion offers the CFSTAT command-line utility to retrieve real-time performance metrics for the system. This feature uses a socket connection to obtain the metrics which can also be used by an attacker to observe privileged information about the system and must be disabled if not in use.

V-279052 in V1R3

Discussion

Application servers provide a myriad of differing processes, features, and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DODDoW system. ColdFusion offers an in-memory file system. This feature can be used to have dynamic code execute quickly which in turns enables an application to execute quicker. This feature can also be used by an attacker to execute dynamic code that is erased and unrecoverable on system reboot making forensic analysis impossible.

V-279053 in V1R3

Discussion

Some networking protocols may not meet organizational security requirements to protect data and components. ColdFusion may host a number of various features, such as the Administrator Console, data sources, and various services. These features all run on TCPIP ports and protocols. This creates the potential for the vendor or ColdFusion administrator to use port numbers or protocols that have been deemed unusable by the organization. When ports or protocols are used that are not secure or authorized by the organization, the ColdFusion feature must be reconfigured to use an authorized port and protocol. For a list of approved ports and protocols, reference the DODDoW ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.

V-279054 in V1R3

Discussion

If ColdFusion is not integrated with an enterprise authentication solution, the system may rely on unmanaged local accounts that are difficult to monitor, audit, and control. This can lead to inconsistent password policies, outdated or orphaned credentials, and a lack of centralized visibility over user access. This STIG standard requires using LDAP as the enterprise authentication mechanism. LDAP integration ensures that authentication is managed through a centralized directory, allowing for strong password enforcement, account lifecycle management, role-based access control, and consolidated audit logging. Without LDAP integration, users may circumvent enterprise identity governance policies, increasing the risk of unauthorized access and administrative oversight gaps. Enterprise authentication also supports incident response and forensic analysis by enabling consistent tracking of user activities across systems. Relying on ColdFusion's internal authentication alone limits these capabilities and weakens the overall security posture. Integrating ColdFusion with an LDAP-based enterprise authentication service ensures alignment with DODDoW security standards, improves identity management, and reduces the risk of account compromise or privilege escalation. Satisfies: SRG-APP-000149-AS-000102, SRG-APP-000118-AS-000078, SRG-APP-000120-AS-000080, SRG-APP-000133-AS-000092, SRG-APP-000148-AS-000101, SRG-APP-000391-AS-000239, SRG-APP-000392-AS-000240, SRG-APP-000402-AS-000247, SRG-APP-000403-AS-000248, SRG-APP-000404-AS-000249, SRG-APP-000405-AS-000250, SRG-APP-000495-AS-000220, SRG-APP-000499-AS-000224, SRG-APP-000506-AS-000231, SRG-APP-000163-AS-000111, SRG-APP-000705-AS-000110

V-279055 in V1R3

Check text

Verify Proxy Settings. From the Admin Console Landing Screen, navigate to ServerPackage SettingsManager >> Settings. If a "Proxy Host" is provided with a "Proxy Username" and "Proxy Password", this is a finding.

Fix text

Configure Proxy Settings. 1. From the Admin Console Landing Screen, navigate to ServerPackage SettingsManager >> Settings. 2. Clear the "Proxy Host", Proxy UserName", and "Proxy Password" fields. 3. Select "Submit Changes".

V-279057 in V1R3

Discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion may use username/password to connect to a mail server. When this authentication method is used, it is important that the credentials be protected when transmitted by being encrypted. While TLS encryption is the preferred method by DODDoW, SSL can be used when the mail server does not offer any other method of encryption. Satisfies: SRG-APP-000172-AS-000120, SRG-APP-000435-AS-000163, SRG-APP-000516-AS-000237

V-279060 in V1R3

Title

ColdFusion must be configured to use only DODDoW-approved keystores and truststores containing certificates issued by a DODDoW Public Key Infrastructure (PKI) Certificate Authority (CA), and all keystore and truststore files must be protected by file system permissions that prevent unauthorized access or modification.

Check text

Verify Keystore Location and Permission. 1. From the Admin Console Landing Screen, navigate to Server Settings >> WebSocket. 2. If the "Use Built-in WebSocket Server" option is selected and the "SSL Port" is checked, make note of the keystore path and filename. 3. From the Admin Console Landing Screen, navigate to Server Settings >> Mail. 4. If "Sign the mail" is checked, record the keystore path and filename. 5. Review JVM truststore settings by navigating to Server Settings >> Java and JVM. 6. Check if JVM Arguments include a truststore setting. For example: -Djavax.net.ssl.trustStore=/path/to/truststore 7. If present, record the truststore path and filename. 8. If the "JVM Arguments" does not contain a truststore setting, note the path and file name of the default "cacerts" file (found under the directory "Java Virtual Machine Path" settings' subdirectory 1lib1security). 9. In each of the ColdFusion instances &ltColdFusion_Installation_Directory>1cfusion1runtime1conf, open the server.xml file. Verify all uncommented connector tags for the word "keystorefile". 10. Record any keystore path and filename. 11. For the keystore/ truststore used, use the keytool command to display the CA certificates for the defined keystore/truststore: keytool -list -keystore &lttrust/key store location> If there are no certificates issued by a CA that is part of the DODDoW PKI/PKE, this is a finding. 12. Verify Permissions on each keystore/truststore file: a. For Windows: The file permissions must grant Full Control only to the Administrators group and the account running the ColdFusion service. No other users or groups should have permissions. If additional permissions are present, this is a finding. b. For Linux: File permissions must be 640 or more restrictive. The owner must be root, and the group must include the ColdFusion runtime user. If permissions are more permissive than listed above, this is a finding.

Discussion

Keystores and truststores are critical components in securing communication between applications and services. If ColdFusion is configured to use certificates that are not issued by a DODDoW-approved Certificate Authority (CA), the authenticity and trustworthiness of encrypted communications cannot be guaranteed. Accepting certificates from untrusted or self-signed sources introduces the risk of man-in-the-middle (MitM) attacks, unauthorized access, and spoofing. Keystore and truststore files contain sensitive cryptographic material, including private keys and trusted root certificates. If these files are not adequately protected at the file system level, unauthorized users may gain access and exploit them to impersonate services, decrypt communications, or alter trust relationships. Insecure permissions may also allow modification of trusted CAs, weakening the system's ability to verify legitimate certificates. Restricting keystore usage to DODDoW-approved certificates and enforcing strict file-level access controls helps ensure data confidentiality, integrity, and authenticity. It also aligns with DODDoW PKI requirements and mitigates the risk of compromise through unauthorized certificate usage or tampering with trust anchors. Satisfies: SRG-APP-000176-AS-000125, SRG-APP-000175-AS-000124, SRG-APP-000427-AS-000264, SRG-APP-000514-AS-000137

V-279063 in V1R3

Discussion

Running unsupported versions of ColdFusion introduces significant risk to the security and stability of the application environment. Unsupported software no longer receives security patches, bug fixes, or vendor support, leaving known vulnerabilities unaddressed and exploitable by threat actors. These versions may contain flaws that have been publicly disclosed and weaponized, making them an easy target for attackers. Continuing to use obsolete ColdFusion versions increases the risk of system compromise, data exposure, and unauthorized access to application resources. Ensuring that only supported and maintained versions of ColdFusion are deployed allows the organization to receive timely updates, apply critical patches, and maintain compliance with DODDoW security requirements. Removing or upgrading unsupported instances helps reduce the attack surface, mitigate vulnerabilities, and ensure ColdFusion processes operate securely and reliably.

V-279102 in V1R3

Discussion

The ColdFusion Performance Monitoring Toolset (PMT) Agent Package provides instrumentation and profiling capabilities that, while useful for performance troubleshooting, introduce unnecessary risk in a DODDoW environment. The PMT agent collects, stores, and transmits detailed information about ColdFusion server activity, queries, and application behavior. If deployed in production, this agent can inadvertently expose sensitive system details, execution paths, or database query patterns to unauthorized individuals. The PMT Agent Package increases the attack surface by adding additional components, services, and ports that must be secured, monitored, and patched. Improperly configured or unmonitored PMT agents could allow adversaries to gain insights into application internals, conduct reconnaissance, or pivot toward exploiting ColdFusion services. By prohibiting the installation of the PMT Agent Package, system administrators reduce complexity, limit potential vulnerabilities, and enforce the principle of least functionality.

V-279129 in V1R3