STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured with secure and approved server settings to enforce application hardening, input validation, error handling, and protection against common web vulnerabilities.

DISA Rule

SV-279050r1171521_rule

Vulnerability Number

V-279050

Group Title

SRG-APP-000141-AS-000095

Rule Version

APAS-CF-000265

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.
• CCI-001664 - Recognize only session identifiers that are system-generated.
• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.
• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002754 - Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure Server Settings.

1. Set "Timeout Requests after seconds" to "5" or adjust according to documented tuning parameters.

2. Check the box to disable access to internal ColdFusion Java components.

3. Uncheck "Allow REST Discovery" if it is currently checked.

4. Review and disallow nonstandard attributes from being passed to ColdFusion tags.

5. Ensure "Allowed file extensions for CFInclude tag" is not empty and does not contain "." unless approved by the information system security officer (ISSO).

6. Check the box to disable creation of unnamed applications.

7. Check the box to use UUID for cftoken.

8. Uncheck "Allow adding application variables to Servlet Context".

9. Uncheck "Check configuration files for changes every".

10. Set "Maximum number of POST request parameters" to "50" or adjust according to documented tuning parameters.

11. Set "Maximum Output Buffer Size" to "1024" or lower.

12. Set "Max Unzip Ratio" to "100" or lower.

13. Set "Request Throttle Threshold" to "4" or lower.

14. Uncheck "Disable CFC Type check".

15. Check the box to prefix serialized JSON.

16. Check the box to enable Global Script Protection.

17. Set "Default ScriptSrc Directory" to a directory other than "/cf_scripts/scripts/".

18. Ensure that "Use UUID for cftoken" is configured to use UUID.

19. Ensure that a prefix is configured for JSON serialization.

20. Ensure that file extensions are appropriately blocked as per policy.

21. Ensure that "Missing Template Handler" is not blank and specifies a valid template path.

22. Ensure that "Site-wide Error Handler" is not blank and specifies a valid template path.

23. Select "Submit Changes".

Check Contents

Verify Server Settings.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Settings.

If "Timeout Requests after seconds" is not set to "5" or is not set in accordance with the documented tuning parameters, this is a finding.

If "Disable access to internal ColdFusion Java components" is unchecked, this is a finding.

If "Allow REST Discovery" is checked, this is a finding.

2. Review the "Allow Extra Attributes in AttributeCollection" setting.

If the nonstandard attributes are allowed to be passed to ColdFusion tags, this is a finding.

If "Allowed file extensions for CFInclude tag" is empty, this is not a finding.

If "Allowed file extensions for CFInclude tag" contains the wildcard string "*.*" or if the list of file extensions is not the list approved by the ISSO, this is a finding.

If "Disable creation of unnamed applications" is unchecked, this is a finding.

If "Use UUID for cftoken" is not checked, this is a finding.

If "Allow adding application variables to Servlet Context" is checked, this is a finding.

If "Check configuration files for changes every" is checked, this is a finding.

If "Maximum number of POST request parameters" is not set to "50" or is not set in accordance with documented tuning parameters, this is a finding.

If the "Maximum Output Buffer Size" is set to a number larger than 1024, this is a finding.

If the "Max Unzip Ratio" is set to a number larger than 100, this is a finding.

If the "Request Throttle Threshold" is set to a number larger than 4, this is a finding.

If the "Disable CFC Type check" is checked, this is a finding.

If the "Prefix serialized JSON with" is unchecked, this is a finding.

If the "Enable Global Script Protection" is unchecked, this is a finding.

If the "Default ScriptSrc Directory" is set to /cf_scripts/scripts/", this is a finding.

3. Review the "Use UUID for cftoken" setting.

If the cftoken is not configured to use UUID, this is a finding.

4. Review the "Prefix serialized JSON with" setting.

If a prefix is not configured for JSON, this is a finding.

5. Review the "Blocked file extensions for CFFile uploads" setting.

If no file extensions are set to be blocked, this is a finding.

6. Validate that the "Missing Template Handler" setting is not blank and that the template specified is a valid.

If the "Missing Template Handler" parameter is blank this is a finding.

7. Validate that the template exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory.
(Example: If the web servers' document root is /opt/webserver/wwwroot and the "Missing Template Handler" is set to /CFIDE/administrator/templates/missing_template_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/missing_template_error.cfm.)

If the "Missing Template Handler" setting is not a valid file, this is a finding.

8. Validate that the "Site-wide Error Handler" setting is not blank and that the template specified is valid.

If the "Site-wide Error Handler" parameter is blank, this is a finding.

9. Validate that the template exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory. (Example: If the web server's document root is /opt/webserver/wwwroot and the "Site-wide Error Handler" is set to /CFIDE/administrator/templates/secure_profile_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/secure_profile_error.cfm.)

If the "Site-wide Error Handler" setting is not a valid file, this is a finding.

Vulnerability Number

V-279050

Documentable

False

Rule Version

APAS-CF-000265

Severity Override Guidance

Verify Server Settings.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Settings.

If "Timeout Requests after seconds" is not set to "5" or is not set in accordance with the documented tuning parameters, this is a finding.

If "Disable access to internal ColdFusion Java components" is unchecked, this is a finding.

If "Allow REST Discovery" is checked, this is a finding.

2. Review the "Allow Extra Attributes in AttributeCollection" setting.

If the nonstandard attributes are allowed to be passed to ColdFusion tags, this is a finding.

If "Allowed file extensions for CFInclude tag" is empty, this is not a finding.

If "Allowed file extensions for CFInclude tag" contains the wildcard string "*.*" or if the list of file extensions is not the list approved by the ISSO, this is a finding.

If "Disable creation of unnamed applications" is unchecked, this is a finding.

If "Use UUID for cftoken" is not checked, this is a finding.

If "Allow adding application variables to Servlet Context" is checked, this is a finding.

If "Check configuration files for changes every" is checked, this is a finding.

If "Maximum number of POST request parameters" is not set to "50" or is not set in accordance with documented tuning parameters, this is a finding.

If the "Maximum Output Buffer Size" is set to a number larger than 1024, this is a finding.

If the "Max Unzip Ratio" is set to a number larger than 100, this is a finding.

If the "Request Throttle Threshold" is set to a number larger than 4, this is a finding.

If the "Disable CFC Type check" is checked, this is a finding.

If the "Prefix serialized JSON with" is unchecked, this is a finding.

If the "Enable Global Script Protection" is unchecked, this is a finding.

If the "Default ScriptSrc Directory" is set to /cf_scripts/scripts/", this is a finding.

3. Review the "Use UUID for cftoken" setting.

If the cftoken is not configured to use UUID, this is a finding.

4. Review the "Prefix serialized JSON with" setting.

If a prefix is not configured for JSON, this is a finding.

5. Review the "Blocked file extensions for CFFile uploads" setting.

If no file extensions are set to be blocked, this is a finding.

6. Validate that the "Missing Template Handler" setting is not blank and that the template specified is a valid.

If the "Missing Template Handler" parameter is blank this is a finding.

7. Validate that the template exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory.
(Example: If the web servers' document root is /opt/webserver/wwwroot and the "Missing Template Handler" is set to /CFIDE/administrator/templates/missing_template_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/missing_template_error.cfm.)

If the "Missing Template Handler" setting is not a valid file, this is a finding.

8. Validate that the "Site-wide Error Handler" setting is not blank and that the template specified is valid.

If the "Site-wide Error Handler" parameter is blank, this is a finding.

9. Validate that the template exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory. (Example: If the web server's document root is /opt/webserver/wwwroot and the "Site-wide Error Handler" is set to /CFIDE/administrator/templates/secure_profile_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/secure_profile_error.cfm.)

If the "Site-wide Error Handler" setting is not a valid file, this is a finding.

Check Content Reference

M

Target Key

5724