ColdFusion web.xml exposed

Question

How can I prevent someone from downloading the web.xml file using a Nessus exploit. I do have access to the ColdFusion administrator and enabled several security settings but WEB-INF/web.xml can still be accessed.I have spent the last 2 hours trying to find the solution online.

Sorry if that is an obvious setting but I don't know much about ColdFusion as I am a IBM Notes administrator...

WolfShade · Answer

Don't use the default CF installation settings for hosting. It will default to {drive}/ColdfusionX/cfusion/wwwroot, and place the CFIDE folder and WEB-INF folder, there. Whatever webserver you're using (Apache, IIS), set it (and CF server) to a different location, and map the CFIDE and WEB-INF directories in CFAdmin.

A good idea would be to follow a Lockdown Guide, when setting up your CF server. Charlie Arehart has a list of preferred guides.

HTH,

^_^

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded