STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Critical ColdFusion directories must have secure file system permissions and ownership.

DISA Rule

SV-279039r1171605_rule

Vulnerability Number

V-279039

Group Title

SRG-APP-000133-AS-000092

Rule Version

APAS-CF-000175

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Update ownership and permissions on ColdFusion directories.

1. Locate the following directories in the ColdFusion installation and in each ColdFusion instance:
- bundles
- bin
- lib
- runtime\lib
- wwwroot\WEB-INF\lib

2. For ColdFusion running on Windows, right-click the directory (e.g., lib) and select "Properties".

3. Select the Security tab and then click "Advanced".

4. On the Permissions tab, click "Disable inheritance" and select "Remove all inherited permissions from this object".

5. Click "Add".
- In the Permission Entry dialog, click "Select a principal".
- Enter the user account running the ColdFusion service.
- Grant full control and then click "OK".

6. Click "Add" again.
- In the Permission Entry dialog, click "Select a principal".
- Enter the Administrators group.
- Grant full control and then click "OK".

7. Check "Replace all child object permission entries with inheritable permission entries from this object".

8. Click "OK" to apply the permissions.

9. Repeat these steps for each of the listed directories.

10. For ColdFusion running on Linux, for each directory (e.g., /opt/ColdFusion2023/cfusion/lib), set ownership and permissions using the following commands, replacing cfuser with the user running ColdFusion:

chown -R <cfuser>:root /path/to/directory
chmod -R 740 /path/to/directory

11. Repeat these commands for each of the identified directories (bundles, bin, lib, runtime/lib, wwwroot/WEB-INF/lib).

Check Contents

Verify critical ColdFusion directories have secure file system permissions and ownership appropriate to the operating system and deployment model.

1. Locate the following directories within the ColdFusion installation for each ColdFusion instance:
<ColdFusion_Install>\bundles
<ColdFusion_Instance>\bin
<ColdFusion_Instance>\lib
<ColdFusion_Instance>\runtime\lib
<ColdFusion_Instance>\wwwroot\WEB-INF\lib

2. For ColdFusion running on Windows, each of the above directories must have "Full Control" granted to:
- The Administrators group.
- The user account running ColdFusion.

If any directory or file within these paths has incorrect permissions, this is a finding.

3. For ColdFusion running on Linux, each directory must meet the following criteria:
- Owner: The user account running ColdFusion.
- Group ownership: root.
- Permissions: Set to 740 or more restrictive.

If the ownership or permissions on any directory or file are incorrect, this is a finding.

Vulnerability Number

V-279039

Documentable

False

Rule Version

APAS-CF-000175

Severity Override Guidance

Verify critical ColdFusion directories have secure file system permissions and ownership appropriate to the operating system and deployment model.

1. Locate the following directories within the ColdFusion installation for each ColdFusion instance:
<ColdFusion_Install>\bundles
<ColdFusion_Instance>\bin
<ColdFusion_Instance>\lib
<ColdFusion_Instance>\runtime\lib
<ColdFusion_Instance>\wwwroot\WEB-INF\lib

2. For ColdFusion running on Windows, each of the above directories must have "Full Control" granted to:
- The Administrators group.
- The user account running ColdFusion.

If any directory or file within these paths has incorrect permissions, this is a finding.

3. For ColdFusion running on Linux, each directory must meet the following criteria:
- Owner: The user account running ColdFusion.
- Group ownership: root.
- Permissions: Set to 740 or more restrictive.

If the ownership or permissions on any directory or file are incorrect, this is a finding.

Check Content Reference

M

Target Key

5724