ColdFusion

Hello All, I am facing weird issue with our application, I have included one component using cfinclude tag in one of the cfm file.Sometimes, my file runs file and includes component successfully but sometimes it gives error "The system cannot find the path specified".It seems weird issue as sometimes cfinclude works fine and sometimes it doesn't. Please help if anyone have faced the similar issue before or have any comments/advise to give.Thanks in advance.

Hello team,I'm Neh Patel, Penetration tester and security researcher.Recenty i was conducting penetration test on a client's infrastructure where i got an old instance of Adobe ColdFusion. After conducting a thorough analysis, we've discerned several vulnerabilities within this instance, which we believe could potentially pose significant security risks.- CVE-2023-38205 - Access Control Bypass ( Bypass of CVE-2023-29298 )- CVE-2024-20767 -  Local File Read## A little introduction about above CVEs### Part 1 :- CVE-2023-38205As you know, When a request originates from an external IP address that is not present in the allow list, access to the requested resource is blocked Example : when you attempt to perform a remote method call wizardHash on the /CFIDE/wizards/common/utils.cfc endpoint from IP which is not in allowed list , the request fails due to the access control being in place CVE-2023-38205 allows an unauthenticated user/attacker to by

In a recent penetration testing engagement with Henil Gandhi, we found an old instance of Adobe #ColdFusion. After conducting a thorough analysis, we've discerned several vulnerabilities within this instance.List of vulnerabilities which we got : - CVE-2023-38205 - Access Control Bypass ( Bypass of CVE-2023-29298 )- CVE-2024-20767 -  Arbitrary file system read using an Improper Access ControlTo exploit CVE-2024-20767, we have to retrive "UUID" by sending a request to "CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat" endpoint.Now we were able to get that "UUID" from above endpoint and we have to use that "UUID" to send a request to "/pms?module=logging" endpoint ( where UUID will work like a cookie ).But we are unable to access that /pms endpoint because of access control ( which we bypassed in the case of "CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat" endpoint with the use of CVE-2023-38205.So need your help with

When I try to install ColdFusion 2023 on Ubuntu 20 in WSL or in a CentOS 7 VM with a GUI with "./ColdFusion_2023_GUI_WWEJ_linux64.bin -i silent", the installation fails with the following output:$ ./ColdFusion_2023_GUI_WWEJ_linux64.bin -i silent Invocation of this Java Application has caused an InvocationTargetException. This application will now exit. (LAX) Stack Trace: java.lang.NumberFormatException: Cannot parse null string at java.base/java.lang.Integer.parseInt(Integer.java:630) at java.base/java.lang.Integer.parseInt(Integer.java:786) at com.macromedia.ia.common.InstallCompleteUtils.setupVariables(InstallCompleteUtils.java:137) at com.macromedia.ia.common.InstallCompleteUtils.init(InstallCompleteUtils.java:45) at com.macromedia.ia.console.InstallCompleteConsole.<init>(InstallCompleteConsole.java:19) at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at java.base/jdk.inter

Hi - I am new to this forum and while I have asked about this as a response to a different two-year-old thread about neo-cron.xml, I worry that it will be harder to see there because it's off-topic.Overly simplifying a sequence of events and intentionally eliding full backstory (for now at least), the long and short of it is that I am looking for a CF2021 copy of neo-query.xml because of an error I received (which I can't quote now because a hasty reversion to a pre-update snapshot removed the log entries containing it) which according to references I consulted at the time seemed to indicate a problem with neo-query.xml. I looked and did not find one. The sequence of events that brought me to that point seemed also to have put some binary into my neo-datasource.xml file. I would like to know if I should have a neo-query.xml file in CF2021 hf 11 and if so, where I could find a copy. (Charlie Arehart's normally extremely helpful archive of neo*.xml files does not have a version of t

Hi Everyone, I have a few dozen scheduled tasks on CF2023 and windows server 2022, with IIS 10 . Some run every minute, some daily, some weekly. They all run fine during the day and act as expected. But every night at midnight all but one of them (an hourly one) stops running. I cant find any errors in any of the logs, the scheduler log only shows the one that does run being triggered. The others just stop at 00:00 and start up again at 06:00. Here is an except from the scheduler log:"Information","DefaultQuartzScheduler_Worker-2","11/12/23","23:58:45","","Task default.AMHS Track Monitor triggered.""Information","DefaultQuartzScheduler_Worker-6","11/12/23","23:59:00","","Task Monitor.AMHS Status Monitor triggered.""Information","DefaultQuartzScheduler_Worker-7","11/12/23","23:59:30","","Task Monitor.AMHS Monitor - Track Monitor triggered.""Information","DefaultQuartzScheduler_Worker-4","11/13/23","00:00:00","","Task default.Pluto Lot Tracker triggered.""Information","DefaultQ

I'm trying to dockerize my ColdFusion developent environment, currently, we use RDP for development but I want do it in a local container. has anyone tried setting up SSL with the official adobe ColdFusion image on docker locally? 

I am trying to move a site that was on CF11 to CF2021 and there is an issue with moving the POI portion which creates excel files to CF2021. The first thing I did look for is to find the version of POI on CF11 (which is 3.12) and the version of POI on CF2021 (Which is 3.17).  The code that is giving me trouble revolves around coloring the foreground of cells.First the workbook is created: <cfset wb = createObject("java","org.apache.poi.hssf.usermodel.HSSFWorkbook").init()/><cfset fontRedUnderlineBold = wb.createFont()><cfset fontRedUnderlineBold.setColor(createObject("java","org.apache.poi.hssf.util.HSSFColor$RED").getIndex())><cfset fontRedUnderlineBold.setUnderline(1)><cfset fontRedUnderlineBold.setBold(true)> <cfset cellStyleCurrency = wb.createCellStyle()/><cfset cellStyleCurrency.setDataFormat(createObject("java","org.apache.poi.hssf.usermodel.HSSFDataFormat").getBuiltinFormat("($##,####0.00_);[Red]($##,####0.00)"))/>&l

Greetings all!In CF 4.51 the following validation code:"<INPUT TYPE="hidden" NAME="minPermSal_range" VALUE="MAX=999999;MIN=10000">"Produced the server side response if your field entry was invalid:*********************************************Form Entries Incomplete or InvalidOne or more problems exist with the data you have entered.The value entered for the Minpermsal field must be between 10000 and 999999 (your entry was 5).Use the Back button on your web browser to return to the previous page and correct the listed problems.*******************************************In CF2023 we get:*********************************************Form entries are incomplete or invalid."<ul><li>The range for the MINPERMSAL field ('5') must have numeric values. </li></ul> Go <a href="javascript:history.back()">back</a> and correct the problem."***********************************To begin with the validation message is incorrect the field in question is de

I am running CF2023 on IIS (moving from an older version of CF).  When I run the configuration tool, it adds two types things to IIS (several handler mappings and an ISAPI filter).  My question is about purpose/necessity the ISAPI filter.  If I remove it, everything seems to continue working as it should.  Let me explain why I want to remove it. The presence that ISAPI filter changes how 404 errors are handled.  When it is not present, all 404 errors are handled by IIS.  When it is present, however, CF handles the .cfm 404s and IIS handles the rest.  I am concerned aboout this for two reasons:  (1) I leverage 404 pages to do my own, in application URL rewrites.  IIS sees the 404, passes it to a template of my choosing, and I then process the cgi.query_string that is passed in.  I can, for example, call a URL that uses a slug (like wordpress does).  My 404 processor checks the slug against the database and calls the proper

Using coldfusion 10.Have a page which import data from a txt file to database. It was reading and importing perfectly earlier. Recently, it is showing request timeout after 10 minutes. Records expected to process was around twenty thousand. File had no changes, so is that happening due to any server settings configuration changes?        

I have a situation where my site uses a Application.cfc file for error trapping. This by itself works fine. I now have some JavaScript I need to add to the entire application so the default would be to add it to Application.cfm but of course I can't use Application.cfm and Application.cfc. Is there a way to add the JavaScript at the Application level either in Application.cfc or some other way?

During installation of CF 2023 I didn't enable the PDF service since I didn't think I would use it.  Now I'd like to add it.  Does anyone know how to do this?  Currently when I go to Data & Services / PDF Service I get this:   Element ENGINE is undefined in THISPDFSERVICE I'm hoping I don't have to uninstall CF and reisntall it.  Thanks

Hi support,  can you help to identify the issue below? the error appears when the number of calls increases compared to normal activity.   Error count: 0 Bytes received: 1467 Bytes sent: 1939691 Free memory: 20162003096 Total memory: 20439891968 Active Sessions: 0""Information","scheduler-1","01/17/24","17:36:30",,"Max threads: 2500 Current thread count: 10 Current thread busy: 0 Max processing time: 350123 Request count: 58 Error count: 0 Bytes received: 1467 Bytes sent: 1939691 Free memory: 20161956776 Total memory: 20439891968 Active Sessions: 0""Information","scheduler-0","01/17/24","17:37:30",,"Max threads: 2500 Current thread count: 10 Current thread busy: 0 Max processing time: 350123 Request count: 58 Error count: 0 Bytes received: 1467 Bytes sent: 1939691 Free memory: 20161834128 Total memory: 20439891968 Active Sessions: 0""Information","scheduler-0","01/17/24","17:38:30",,"Max threads: 2500 Current thread count: 10 Current thread busy: 0 Max processing time: 350123

Hi,I know that this was question was asked in https://community.adobe.com/t5/coldfusion-discussions/cf-2018-auto-lockdown-states-the-server-is-not-running/m-p/12174409 but no answer was given.  I know that I ultimately figured it out but forgot to document it.When I run the CF 2021 lockdown tool I get the following error:"ColdFusion server is nor running.  Please start the server and try again." But Coldfusion's instances  (2) are running! the lockdown logs look like:2024-01-19 15:53:51 INFO - ColdFusion is not running. Please start ColdFusion using services and try again.2024-01-19 15:54:00 INFO - Path:d:\ColdFusion2021\lockdown\cfusion2024-01-19 15:54:00 INFO - LINE_DEBUGGER_ENABLED -> null2024-01-19 15:54:00 INFO - developer_enabled -> false2024-01-19 15:54:00 INFO - REMOTE_INSPECTION_ENABLED -> null2024-01-19 15:54:00 INFO - ajax_enabled -> false2024-01-19 15:54:00 INFO - robust_enabled -> false2024-01-19 15:54:00 INFO - FLASHFORMCO

 anyone knows what this error isError executing query : Unexpected EOF; was expecting a close tag for element <str> thank you

We migrated our Coldfusion 2023 Windows Server to a new server over the weekend, and "cfhtmltopdf" has stopped working.  It can generate a PDF fine and display it, but when actually trying to save it to the server, we get this:<cfhtmltopdfdestination="c:\filename.pdf"  source="http://#CGI.Server_Name#/filename.html" overwrite="true"></cfhtmltopdf> Jan 31, 2024 13:16:12 PM Error [ajp-nio-127.0.0.1-8022-exec-24] - Connect to 127.0.0.1:8995 [/127.0.0.1] failed: Connection refused: connect http://127.0.0.1:8995/PDFgServlet/Jan 31, 2024 13:16:12 PM Error [ajp-nio-127.0.0.1-8022-exec-24] - Error occurred while generating PDF. Not sure if this helps, but http://127.0.0.1:8995/PDFgServlet/ brings up: HTTP ERROR 400 Bad RequestURI: /PDFgServlet/STATUS: 400MESSAGE: Bad RequestSERVLET: PDFgServletPowered by Jetty:// 9.4.51.v20230217 The service for Coldfusion2023add-onservice is running, and port 8995 is open.   Any ideas/suggestions?

I am facing an issue while creating pdf using cfdocument tag where the content are Arabic characters. When I am printing the Arabic in web page(HTML) everything works fine, but when I put the same characters in pdf few ligature(joint letters) are missed out. I have added the code below which creates the pdf in the same location where the file is run and display the content on screen. I have underlined the characters on screen display, which are missed out while rendering the texts in pdf. Is this a bug in cfdocument? Any help is much appreciated.  <cfprocessingdirective pageEncoding="utf-8"><cfdocument name="TT" format="pdf" fontEmbed="Yes" margintop="1.1" marginbottom="0.5" backgroundVisible="Yes" pagetype="a4" orientation="portrait">اسم المالك<br>المبلغ المس&#1

Good morning, In order to be able to put an icon, I test if the file exists!   <CFIF fileExists ("#DIRV#")> <A href="../../Admin/_ebooks/Libre_Video.cfm"><img src="../../Admin/_Pictures/Video.gif" width="30" height="30" title ="Presentation Video" /></A> </CFIF> But since I'm in a loop, I'm going to get negative answers! Here is the error message:Security: The requested template has been denied access to /SoLivres/_Ouvrages/APED/Auteurs/IRLES/UNE_ENFANCE_PIEDS-NOIRS/Videos/UNE_ENFANCE_PIEDS-NOIRS.mp4. The following is the internal exception message: access denied ("java.io.FilePermission" "/SoLivres/_Ouvrages/APED/Auteurs/IRLES/UNE_ENFANCE_PIEDS-NOIRS/Videos/UNE_ENFANCE_PIEDS-NOIRS.mp4" "read")Thank you for your help. Bonjour,Afin de pouvoir mettre une icone, je teste si le fichier existe ! <CFIF fileExists ("#DIRV#")> <A href="../../Admin/_ebooks/Libre_Video.cfm"><img src="../../Admin/_Pictures/Video.gif" width

I'm getting this warning in the coldfusion-out.log everytime the application restarts. It started after I installed CF2021 update 12 on Centos 7.9. Using mod_jk connector. I've looked in this post: https://community.adobe.com/t5/coldfusion-discussions/weirdness-after-cf-auto-lockdown-tool/m-p/14111440, however I did not run the lockdowntool.Could someone please explain what this package is used for and is this warning something to look into closely? WARN [main] - Unable to determine dialect of the StAX implementation at jar:file:/CF_HOME/coldfusion2021/appinstance1/lib/bundleaxis/wstx-asl-3.2.9.jar!/ Thank you!

OK.  One last item to cure with respect to applicant searches.In CF 4.51 the collection for applicants was based on a huge folder containing .txt files.In CF 2023 the colleciton is based on a huge folder containg: .doc, .docx, .pdf & .txt files. The code that worked against the .txt file collection was.****************************values (#getCurrentSearchID.theSearchID#, #Replace( replace( URL, "/", "" ), ".txt", "" )#)****************************Basically, it stripped off the .txt part of the file name & the "/" that solr inserts into the value of URL> so that we are left with the file # to use in further processing.I have tried the following against the folder with the 4 extensions mentioned above.***************************values (#getCurrentSearchID.theSearchID#, #Replace( replace( URL, "/", "" ), (".doc" or ".docx" or ".txt") ", "" )#)***************************CF is not happy with my (".doc" or ".docx" or ".txt") construct.  Would very much appreciate an

So, on my website I have this code that works when it comes to sending an email to the website owner. This is from contact form. Somebody will populate stuff and send to the owner.    <!--- Send email after successful registration ---> <cfmail server="131.153.102.58" from="support@almarsguides.com" to="#form.email#" subject="Sample CF e-mail"> This is the body of a test email. </cfmail>  However, I want to make registration where user will recieve email to finish registration, however, this is what is happening.   <cfmail server="smtp.gmail.com" port="587" useSSL="false" username="AlmarsGmailEmail" password="TEST" from="support@almarsguides.com" to="#form.email#" subject="Sample CF e-mail"> This is the body of a test email. </cfmail>    I changed password here

Hello, I have recently installed cfmx 2023 but however I'm unable to access the admin page using the credentials I have provided via silent install. I have done two things here -->1. It first had localhost(default I believe) in allowedAdminIPList but then I have removed it and restarted cfmx.  so, now I can see the admin page(planning to restrict through in next phase but wanted to get somewhere) . However,  when I provide the admin credentials it gives me 4032.   later, I tried changing the admin.security.enabled from true to false. and I was  able to view the admin page without passing credentials. However, I believe thats not the right way and its a security risk.  I'm not quite sure what the issue is here. can someone provide any inputs on what could be the issue? Stack details:CFMX version : 2023OS : RHEL9Tomcat : 9.0.86JDK17 Thanks,Manoj

So, does anyone have a clue why coldfusion would return a different value from a mysql datetime?I've got a 4 hour difference. Is there some setting I'm missing? Orm or Query. This is bizarre.(Aside from cf adding in milliseconds of 0) Orm record: Database record: Query records: Database records:  

Does not seem to be a rhyme or reason to this, but every once in a while I getjavax.servlet.ServletException:Application v1 could not be found.The App CFC in the dir has the name component {  this.name = "v1";  this.applicationTimeout = createTimeSpan(1, 0, 0, 0); I saw some other answers that could be the application timing out, but it happens more than once a day.