Skip to main content
S
sai santhoshp14907680
Known Participant
February 11, 2018
Answered

ColdFusion Datasource

  • February 11, 2018
  • 3 replies
  • 1575 views

I would like to know the current password for my data sources in ColdFusion 11, what is the process for that... If the password is in encrypted form how to decrypt it.

This topic has been closed for replies.
Correct answer Dave Watts

I don't think it can be decrypted. The passwords stored by CF are hashed, not encrypted. If you had a table of values that were hashed using the same seed that CF is configured to use, you could probably identify the original password from that, but CF does let you change the seed so that seems less likely to work.

But if your goal is to find this out, why not go to whoever manages the database server and just ask?

Dave Watts, CTO, Fig Leaf Software

3 replies

B
Bardnet
Inspiring
February 11, 2020

The password is stored encrypted. It is always advised to hash passwords. ColdFusion cannot do this because the password is needed in clear text to establish a new connection to a database.

ColdFusion used to have one global key. This was changed some times back, so when ColdFusion is installed a seed is generated and every password is encrypted using this key.

 

There is this article explaining many things including how to read the passwords using the AdminAPI and decrypt them: https://medium.com/@cfmike/retrieve-coldfusion-datasource-passwords-4c1064b91548

Prior to CF10 the seed and agorithm are fixed values and are “0yJ!@1$r8p0L@r1$6yJ!@1rj” and “DESede” respectively. For CF10 and beyond you will need to retrieve these values from the seed.properties file.

 

 

 

E
esmartbranding
Participant
February 10, 2020

You could unhash it using cfconfig a plug-in from Ortus. CFConfig takes all your datasources and makes it into a json file which can be easily read.

 

Give it a try. Good luck!

Al Serize

Sr. Web Eng.

D
Community Expert
Dave WattsCommunity ExpertCorrect answer
Community Expert
February 11, 2018

I don't think it can be decrypted. The passwords stored by CF are hashed, not encrypted. If you had a table of values that were hashed using the same seed that CF is configured to use, you could probably identify the original password from that, but CF does let you change the seed so that seems less likely to work.

But if your goal is to find this out, why not go to whoever manages the database server and just ask?

Dave Watts, CTO, Fig Leaf Software

Dave Watts, Eidolon LLC
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices