ColdFusion Lockdown Series - Multiple Partitions

One of the most frequent questions I get about the Adobe ColdFusion 9 Lockdown Whitepaper is:

Why do you suggest using 3 partitions when installing ColdFusion?

First lets get out of the way what the partitions are for:

1. Operating System (typically the C:\ drive or partition)
2. ColdFusion Installation
3. Your Web Root (eg your CFM files)

How does this make my ColdFusion server more secure?

Consider a directory traversal vulnerability, here's what one looks like in CFML:

<cfinclude template="includes/#url.file#">

Now I can make a request like this: exploit.cfm?file=../../config.xml the contents of that file will be output as long as ColdFusion has permission to read it.

If I installed everything on the same drive (eg c:\) this exploit is a whole lot more dangerous because the hacker can read any file on the server that ColdFusion has access to. With separate partitions you are limited to reading files on the same drive letter.

A few things to note:

• A directory traversal exploit could and has existed in web servers and within ColdFusion administrator (make sure you are all patched up, and give HackMyCF a try). So your code is not the only place such an exploit could take place.
• The more drives the better, 3 is a minimum, you can also create additional partitions for logs, or other apps.
• This advantage is fairly specific to Windows servers (since everything falls under / on UNIX), but there may be other advantages to having multiple partitions as well.