3

I have a ColdFusion app in which I wish to restrict access to certain pages, based on some criteria. I am currently doing it like this, in Application.cfc:

<cffunction name="OnRequestStart" access="public" returntype="boolean" output="true">
  <cfargument name="TargetPage" type="string" required="true" />
  <cfif not SESSION.isAdmin and REFindNoCase("/admin",ARGUMENTS.TargetPage) >
    <!--- Deny non-admin access to admin pages. --->
    <cfinclude template="/notauth.cfm">
    <cfreturn false />
  </cfif>
  <cfreturn true />
</cffunction>

My main concern is: How vulnerable is the general approach of checking TargetPage against a regex, and are there ways to improve the security of this design? Specifically, I'm concerned about avoiding "canonical representation vulnerabilities." See here.

For example, using just a REFind instead of REFindNoCase would let people slide right on through if they went to "/ADMIN/". Are there are other things to watch out for here?

I know there are other designs, like using another Application.cfc in a subfolder, or doing checks right in the page code. But I like the idea of having all my security code in one place. So please only suggest those in your answer if there's no way to do the above securely, or if it's just really a bad idea for some reason. Thanks.

2
  • Edit: Specifically, I'm concerned about defending against "canonical representation vulnerabilities." Does ColdFusion canonicalize TargetPage well enough that crackers can't "trick" the regex by doing things like "/blah/../aDmi&#n;/./index.cfm" ?
    – CrazyPyro
    Feb 4, 2011 at 18:42
  • Some experimentation seems to show that ColdFusion (or maybe the web server in front of it) is canonicalizing the URL by the time it appears in OnRequestStart. So the regex shouldn't have to look out for the kind of thing at the end of my last comment.
    – CrazyPyro
    Feb 16, 2011 at 7:06

3 Answers 3

1

I'm sure there are reams of this stuff on the internets but here is my take on it :)

They way I would solve your specific example is to maintain a database list of scripts that are restricted (a blacklist) unless you are a member of a certain group (i.e. you are an admin).

You can make this as complicated as you wish but for a simple start you could compare the full script name (CGI.SCRIPT_NAME) to a query of queries representing blacklisted pages you store in the APPLICATION scope that you loaded in onApplicationStart() called qRestrictedList.

So in onRequestStart you could do the following:

<cfquery name="qThisPageRestricted" dbtype="query">
  SELECT * FROM qRestrictedList
  WHERE ScriptName = '#CGI.SCRIPT_NAME#'
</cfquery>

<cfif qThisPageRestricted.recordCount and not SESSION.isAdmin>
  <cfinclude template="/notauth.cfm">
  <cfreturn false />
</cfif>

Even better, you can expand on this at a later date by wrapping all this in a 'authentication' CFC and creating user groups and levels, i.e. move your logic out of onRequestStart() and encapsulate it.

But as a start, storing the data in the database might be a more maintainable way for you to get this done and provide a better foundation for future changes to how your authentication works.

I hope this helps.

3
  • Although I like the database idea, my specific question was about the security of comparing regex against ARGUMENTS.TargetPage. In your example, you are checking CGI.SCRIPT_NAME - Is that less vulnerable to tricks than TargetPage? (I'm pretty sure they are the same.)
    – CrazyPyro
    Feb 4, 2011 at 18:15
  • I guess I'm advising abandoning regex pattern matching in place of explicit checks. Also CGI.SCRIPT_NAME is just the actual script name with no path info. Either could be used. Feb 4, 2011 at 21:09
  • It looks to me like CGI.SCRIPT_NAME and the argument to onRequestStart are both the same: canonicalized relative URL to the page.
    – CrazyPyro
    Feb 16, 2011 at 7:10
0

It may worth to make regex a bit stricter:

REFindNoCase("\/admin\/([A-Za-z_]+)\.cfm", ARGUMENTS.thePage)
2
  • Although that regex is "stricter," for that reason it actually wouldn't catch something like "/admin/./index.cfm" unless I'm wrong about how onRequestStart handles URLs - see my comment on my question.
    – CrazyPyro
    Feb 4, 2011 at 18:45
  • Per my 2nd comment on my question, I stand corrected on the /./ or /../ being a problem. But... there is still a problem with your new regex: what if someone goes to /admin/user2xml.js.cfm
    – CrazyPyro
    Feb 16, 2011 at 7:16
0

A better approach would be to put an application.cfc in the /admin directory that controls access (maybe based on a SESSION variable set through logging in as an admin), and have that "child" application.cfc reference the parent one if necessary.

See this question for an example on how to do this: Extending application.cfc in a subdirectory

3
  • Per the end of my question, can you explain why this is a better approach? Specifically, is it more secure, and why? (I am already using your technique to inherit sub-applications for a master, and they each use different regex filtering. So the question still stands, is the regex approach itself secure or not.)
    – CrazyPyro
    Feb 4, 2011 at 18:04
  • Your regular expression is not necessarily secure, as there could be lots of paths that contain /admin. As sergii suggested you can make the pattern match stricter to help the security, but you also tradeoff some flexibility as you might need to change the admin directory or other cases (partial admin or unprotected pages).
    – Goyuix
    Feb 5, 2011 at 5:00
  • Per Sergii's answer, I think there's a point at which making the regex too strict would actually hurt security rather than help, by failing to match a path you intended to protect. But I can also appreciate that making it too loose might accidentally lock someone out of a page we didn't mean to protect, like '/admin' blocking '/adminAssistantsDay.cfm' or something.
    – CrazyPyro
    Feb 16, 2011 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.