ColdFusion

Regarding the latest CF Hotfix (ColdFusion (2021 release) Update 13) and Fusebox5 applications. We have a legacy application in our organisation which died completely when Hotfix13 was applied. Almost every request produces a "Variable FUSEACTION is undefined." error. We have a temporary fix whereby we can set the server variable "Searchimplicitscopes" to true, but this is only a temporary solution. Has anyone else had this problem with Fusebox applications, and does anyone have a strategy for fixing it? 

We connect to a partner organization daily to grab sets of files using sFTP.  We had received notice from them that they were deprecating ssh-rsa and only supporting rsa-sha2-256 and rsa-sha2-512 going forward.  Well the day has come and apparently CF2018 (and 2021) using ssh-rsa as our connections have failed.  There's nothing in any documents or articles that we can find about switching, forcing or upgrading the CFFTP algorithm other than some bugs with CF2011 and a zlib jar.  Any help or ideas on how to get around this? 

Day of week is displayed incorrectly, as if the date is in US format mm/dd/yyy.  How can I fix this?(UK format is dd/mm/yyyy)egDatepart for 01/05/2002 returns value of 7 for Saturday (not 4 for Wednesday).UK : 01/05/2002 = 1 May 2002 = Wednesday.US : 01/05/2002 = 5 Jan 2002 = Saturday. More puzzling is that Datepart for 21/04/2022 returns 5 (for Thursday), when it should return 1 for Sunday, and in a US format a month of "22" is not valid anyway.From my test output :01/05/2002 Wed is output as datepart & day of week : 7 day of week Saturday21/04/2022 Sun is output as datepart & day of week : 5 Thursday22/04/2022 Mon is output as datepart & day of week : 6 Friday23/04/2022 Tue is output as datepart & day of week : 7 Saturday24/04/2022 Wed is output as datepart & day of week : 1 Sunday25/04/2022 Thu is output as datepart & day of week : 2 Monday26/04/2022 Fri is output as datepart & day of week : 3 Tuesday27/04/2022 Sat is output as datepart & da

We upgraded from CF2018 to CF2023 a few months back and since the upgrade we have a cfimap call getting hung on emails here and there.  Most of the emails retrieval work as they should, however, one will bring ColdFusion down and hang the rest of the sites on the server.  Once the offending email has been removed from the queue the server will recover.  The process has been allowed to run for 5-10 mins and the cfimap process will not be able to clear it.  The other sites are down during this time. We are not sure what is happening for sure.  One thing we are leaning towards is the email attachment size.  The emails that this has happen on seem to have attachments that are around 14 MB in size.  We are wondering if there is a JVM setting that may need to be updated to allow for the processing of a bit larger files? What would be different between CF2018 and CF2023 for cfimap that would cause this? Any insight would be helpful. Thanks.&nb

Kind of a dumb question, but I can't find this in the documentation. I inherited an old ColdFusion server with several existing scheduled tasks. I rebuilt the server from scratch, and imported the scheduled tasks, which run on a user account "taskrunner." My question is where should I put this account? Does it need to be a local user account on the IIS server that hosts ColdFusion, or is there somewhere in ColdFusion where I need to create/define this account? I am a bit confused becuase the old server does not have a local account with the name "taskrunner" yet the tasks were running before the rebuild, and do not run now. Clearly the account must be created somewhere, but where?

You may have noticed in the last few versions of Dreamweaver CC that ColdFusion support is slowly being removed from the program.  Officially Adobe's answer is that developers should switch over to ColdFusion builder instead.  Unfortunately for many of us ColdFusion builder is not a Dreamweaver replacement.  There are some things that ColdFusion builder does very well, but Dreamweaver still has features that CF Builder lacks.  If you're like me then you probably develop with BOTH ColdFusion Builder and Dreamweaver together in unison in your projects.I have submitted a feature request to the Dreamwevaer development team to officially request that CFML support be re-instated within Dreamweaver.  The request has been assigned an ID number (3609524) and I was told that if enough people request this feature they will implement it.It would be great if you could help let Adobe know that ColdFusion is still a viable language and that you don't want to see it removed fr

I am getting File Not Found when trying to move the WWWROOT directory to another drive with CF2023 and VSCode/CFBuilder. As a note, I have not setup any of the following components before so the issues are due to that.   I installed the following on a win 10 laptop to try for CF development. Coldfusion 2023 Dev (ColdFusion_2023_WWEJ_win64) with Tomcat VSCode (VSCodeUserSetup-x64-1.87.2) And added CFBuilder to VSCode. The default Coldfusion wwwroot is at C:\ColdFusion\cfusion\wwwroot I need to change the wwwroot to D:\mydir\wwwroot but have been unable to make it work. I get a file not found before it even gets to the web page. The closest I have got was to add a Linked directory to the project and it now launches the web to D:\mydir\wwwroot\index.cfm and then shows the File not found on the web page. I looked in the error log and it shows: Error [http-nio-8500-exec-1] - File not found: /WebTest/index.cfm  The specific sequence of files included or processed is: C:\ColdFusion\

I am getting the error posted in the title, the full error is the following... Cannot invoke "coldfusion.server.LicenseService.isStandard()" because the return value of "coldfusion.server.ServiceFactory.getLicenseService()" is null I have applied the hotfix-007 patch already as per instructions from https://www.carehart.org/blog/2023/10/10/solving_problems_applying_latest_cf_updates Any help is appreciated, thank you.

When I took over the care of a CF intranet site, the Google chart API was being used to generate QR codes that are on employee badges; this won't be working for much longer and I need to find a replacement.   <cfimage source="#myImage#" destination="c:/workgroups/webdata/badgecards/#BadgPhotoName#" action="write" overwrite="Yes"> <cfhttp url="https://chart.apis.google.com/chart?chs=160x160&cht=qr&chl=#urlencodedformat('http://www.ohrc.org/binkley/BadgeCard/PDFs/#Replace(BadgPhotoName,'.jpg','.pdf','All')#')#&chld=H|0" result="qrcode" getasbinary="yes"> <cfimage action="write" destination="c:/workgroups/webdata/badgecards/qr/#Replace(BadgPhotoName,'.jpg','.png','All')#"  source="#qrcode.filecontent#" overwrite="yes"> This is what the code looks like I found a new generator, but I haven't been able to get it to work correctly.  The generator that I was looking at is goqr.me/api,

We have an old but important website that we are in the process of bringing into the 21st century. The front-end is IIS with multiple backend servers including Cold Fusion and a standalone Tomcat 8.5 running with java 7 on Linux. This configuration is working fine with the current configuration using Cold Fusion 9 and the corresponding isapi_redirect.dll provided with CF9.As soon as we upgrade to anything newer than CF9, connections to the standalone Tomcat servers through isapi_redirect start to fail. Packet captures seem to indicate that there is significantly more data being sent to AJP from the newer isapi_redirect than before. We have tried using all versions of isapi_redirect from Adobe newer than CF9 and they all fail to talk nice to a tomcat server. Alternatively, if we use the isapi_redirect from the apache foundation, tomcat works, but Cold Fusion fails.It certainly appears that Adobe has made customizations to their version of isapi_redirect that are incompatible with standa

Anyone here running an application using Fusebox4 on ColdFusion 2023?   I have just installed ColdFusion 2023 (Update 7) on a new server and i'm trying to migrate my existing application that is currently running on a ColdFusion 2016 on the Fusebox 4 framework.   I'm running into an issue where my application variables that I am setting are not being set/available.  My first thought was the scope issue seen in Update 7 but I don't think so because the error message contains the application scope.  I think the Fusebox4 preProcess plugins are not loading.  In these plugins I setup the application variables. Error Received:  Element SYSTEM is undefined in APPLICATION.The error occurred in //nagennas02/ColdFusion2023/mdocftest/gms/Application.cfc: line 198196 : </cfsavecontent>197 :198 : <cflog file="#application.system#" text="#arguments.exception.message#">199 :200 :Stack Traceat cfApplication2ecfc884102023$funcONERR

We're currently observing Daylight Saving Time in the UK, so local time is UTC +01:00 (as opposed to UTC +00:00). When a ColdFusion datetime is output to the page, no UTC offset is displayed, leading me to assume it didn't account for them. The code below shows local time and UTC as being 1 hour apart (18:10 and 17:10 respectively), but DateCompare() insists both datetimes are the same, which is only true if each datetime's UTC offset is considered in the comparison. Are ColdFusion datetimes stored with a UTC offset? If so, is there any way to access it? Thanks. P.S. No ColdFusion option in Insert Code Sample. Seriously?!?  <cfset now = now()> <cfset utcNow = dateConvert("local2utc", now)> <cfoutput> now: #now#<br> utcNow: #utcNow#<br> dateCompare(now, utcNow): #dateCompare(now, utcNow)#<br> </cfoutput> <cfdump var="#GetTimeZoneInfo()#">  now: {ts '2024-04-15 18:10:24'}utcNow: {ts '2024-04-15 17:10:24'

Hello,I have installed Coldfusion 2023 Performance Monitoring Toolset with the default settings in drive C in a Windows 2022 Standard Server. The drive is becoming full, so I would like to move the Datastore to a different drive. How can I move the PMT datastore to a different Windows drive  ? Alberto S.

We have recently upgraded our test server from ColdFusion 8 Enterprise server to ColdFusion 10 64-bit Enterprise server, running IIS 7.5 on a Windows 2008 R2 server.  We left the CF 8 install in place while we upgraded to CF 10.  CF 10 installed without any errors and our CF 10 websites are working properly.  It is fully patched to Update 11.  There is one function on one of the websites that was written in JSP and worked fine in CF 8.  Any call to a JSP template in CF 10 renders a 404 error, when the file is clearly available in the file system.The proper handler mappings and MIME types appear to be in place in IIS.  Attached is a portion of the ISAPI_redirect.log, which includes the debug information. The 404 error appears at the end of the log excerpt.   I've replaced the server name and IP address with SERVER NAME and IP ADDRESS in the log below.I have not uninstalled CF 8 at this point, but considering it as a last resort to try to install a

Hi, I am getting the error below when trying to install on windows 11 Unable to Launch Java ApplicationThe properties files is missing an essentail property file: lax.main.classPlease make sure it exists in the properties file C:/1713185448/windows/adobe_cf1.lax I do NOT see the file adobe_cf1.lax in the folder I unzipped to (see screenshot)      

i am trying to use jmx exporter in my coldfusion 2021, i have added to the jvm args like this -javaagent:{application.home}/jmx/jmx.jar=9101:{application.home}/jmx/config.yamlit works fine in an standalone ubuntu server, i can see the metrics exported at port 9101, but when i do the same inside docker container it give me error """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""Exception in thread "main" java.lang.reflect.InvocationTargetException at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at java.instrument/sun.instrument.InstrumentationImpl.loadClassAndStartAgent(InstrumentationImpl.java:513) at java.instrument/sun.instrument.Ins

When I clear the template or component cache, the changes I made in the respective files are not showing. Upon inspecting the page, I see the following: 

Uncaught SyntaxError: parseJSON (at cfajax.js:889:7)at Object.decode (cfajax.js:889:7)at $X.processResponse (cfajax.js:571:24)at $X.callback (cfajax.js:536:13)at _7ef (cfajax.js:522:4)at $A.callback (cfajax.js:179:1)at req.onreadystatechange (cfajax.js:131:4)Code at line-889:- throw new SyntaxError("parseJSON");

I am running the official Docker Coldfusion Container:eaps-docker-coldfusion.bintray.io/cf/coldfusion:latest When I try to create a PDF using <CFDOCUMENT>, I receive the following error message.I know that lucee had some problems with this based on the Java version, but I assumed that the official image/container would work. Here is the code block it works great on the exact same version of ColdFusion installed locally. <cfdocument format="pdf" scale="#URL.scale#"> <cfoutput>#cfhttp.filecontent#</cfoutput> </cfdocument>  Thank you

I recently upgraded from ColdFusion 2018 (CF2018) to ColdFusion 2023 (CF2023). However, I've encountered an issue where I'm unable to download files within the new version. Despite completing the upgrade process, attempts to initiate file downloads are failing.Message The requested resource [/path/file_name.csv] is not availableDescription The origin server did not find a current representation for the target resource or is not willing to disclose that one exists. 

Base.cfc: component accessors="true" { public string function getFilterSql(required array filter) { ... filter["operator"] ?: "" //null-exception ... filter.operator ?: "" //null-exception ... isDefined('filter.operator') ? filter.operator : "" //works } Comp.cfc:component extends="Base" rest="true" produces="application/json" restpath="xyz" { remote struct function getX() httpMethod="GET" { var filterSql = getFilterSql(filters); } }When I copy the function from Base.cfc into Comp.cfc ELVIS is working as it is suppose to.Thank you in advance!

Hello All, I am facing weird issue with our application, I have included one component using cfinclude tag in one of the cfm file.Sometimes, my file runs file and includes component successfully but sometimes it gives error "The system cannot find the path specified".It seems weird issue as sometimes cfinclude works fine and sometimes it doesn't. Please help if anyone have faced the similar issue before or have any comments/advise to give.Thanks in advance.

Hello team,I'm Neh Patel, Penetration tester and security researcher.Recenty i was conducting penetration test on a client's infrastructure where i got an old instance of Adobe ColdFusion. After conducting a thorough analysis, we've discerned several vulnerabilities within this instance, which we believe could potentially pose significant security risks.- CVE-2023-38205 - Access Control Bypass ( Bypass of CVE-2023-29298 )- CVE-2024-20767 -  Local File Read## A little introduction about above CVEs### Part 1 :- CVE-2023-38205As you know, When a request originates from an external IP address that is not present in the allow list, access to the requested resource is blocked Example : when you attempt to perform a remote method call wizardHash on the /CFIDE/wizards/common/utils.cfc endpoint from IP which is not in allowed list , the request fails due to the access control being in place CVE-2023-38205 allows an unauthenticated user/attacker to by

In a recent penetration testing engagement with Henil Gandhi, we found an old instance of Adobe #ColdFusion. After conducting a thorough analysis, we've discerned several vulnerabilities within this instance.List of vulnerabilities which we got : - CVE-2023-38205 - Access Control Bypass ( Bypass of CVE-2023-29298 )- CVE-2024-20767 -  Arbitrary file system read using an Improper Access ControlTo exploit CVE-2024-20767, we have to retrive "UUID" by sending a request to "CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat" endpoint.Now we were able to get that "UUID" from above endpoint and we have to use that "UUID" to send a request to "/pms?module=logging" endpoint ( where UUID will work like a cookie ).But we are unable to access that /pms endpoint because of access control ( which we bypassed in the case of "CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat" endpoint with the use of CVE-2023-38205.So need your help with

When I try to install ColdFusion 2023 on Ubuntu 20 in WSL or in a CentOS 7 VM with a GUI with "./ColdFusion_2023_GUI_WWEJ_linux64.bin -i silent", the installation fails with the following output:$ ./ColdFusion_2023_GUI_WWEJ_linux64.bin -i silent Invocation of this Java Application has caused an InvocationTargetException. This application will now exit. (LAX) Stack Trace: java.lang.NumberFormatException: Cannot parse null string at java.base/java.lang.Integer.parseInt(Integer.java:630) at java.base/java.lang.Integer.parseInt(Integer.java:786) at com.macromedia.ia.common.InstallCompleteUtils.setupVariables(InstallCompleteUtils.java:137) at com.macromedia.ia.common.InstallCompleteUtils.init(InstallCompleteUtils.java:45) at com.macromedia.ia.console.InstallCompleteConsole.<init>(InstallCompleteConsole.java:19) at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at java.base/jdk.inter