Skip to main content
Jdsplicer
Jdsplicer
Inspiring
October 27, 2020
Question

HTTP Response Splitting in CF2018

  • October 27, 2020
  • 1 reply
  • 940 views

Hi, we recently had a security scan on one of our apps and we were dinged with "HTTP Response Splitting" issue. It occured on my .CFC pages. Below is what the testers performed on my CFC and the results.

 

 

I am running CF2018 Enterprise 2018.0.09.318650. I was curious if anyone had any suggestions on how to remediate this. My first step was to make sure "Enable Global Script Protection" was checked in the cfadmin, which it is. From there I believe the neo-security.xml file can be updated to help prevent CRLF injection, not sure what that would look like. Quite honestly I am not sure if that is the best or proper method. I get a little leary messing with some of the CF underlying files. Anyone have any other or better ideas?

 

Thanks

    This topic has been closed for replies.

    1 reply

    James Moberg
    James Moberg
    Inspiring
    October 27, 2020

    I noticed that the page was actually 404.  I performed a similar GET request against a CF2016 (non-enterprise) server to a non-existent CFC script and didn't see the extra response header returned.  I appended the following string to the URL param (I hope that I got it right) and it wasn't returned.

    %0d%0aAppScanHeader:%20AppScanValue%2f1%2e2%2d670%0d%0aSecondAppScanHeader:%20whatever

    Do you have any other technologies in front of the ColdFusion server?

    Which web server are you using?  (We use IIS.)

    Are you able to perform the test yourself on the server?

    Are you able to perform the same test on other known ColdFusion servers?

    Jdsplicer
    JdsplicerAuthor
    Inspiring
    October 27, 2020

    Hi Jamo, we are running on top of WebSphere 9. I actually get a 403 forbidden error when I try to replicate what they did and I do not see those values in the request or response headers but only in the query string parameters from the URL. I am asking them to rescan to see if the issue still exists.

     

     

    Thanks.

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    October 28, 2020

    Same in my test. The 'AppScanHeader' values come out as query-string parameters.

     

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices