Pete Freitag Pete Freitag

ColdFusion Summit 2024 Slides: 20 ways to secure CF

Published on October 04, 2024
By Pete Freitag
coldfusion

This year at the Adobe ColdFusion summit in Las Vegas I presented on 20 ways to secure ColdFusion. You can download my slides here.

When giving a presentation on security there are certain topics that I feel need to be covered like SQL Injection, but I also wanted to highlight a few other things that might be new to some people. Here's an outline of the topics covered:

  1. Block Remote CFC's
  2. Add more validation
  3. Outsource Authentication
  4. Add audit logging
  5. Add onError to Application.cfc
  6. Securing File Uploads
  7. Encode Outputs to prevent XSS
  8. Content Security Policy (CSP) Headers
  9. PDF Injection
  10. Avoiding Server Side Request Forgery (SSRF) in ColdFusion
  11. RCE via ColdFusion's Evaluate Function
  12. RCE via ColdFusion's IIF Function
  13. Preventing SQL Injection in CF
  14. Leverage Continuous Integration (CI)
  15. Avoiding XML Entity Injection in ColdFusion
  16. Clear-Site-Data HTTP Response Header
  17. Avoid EOL ColdFusion Versions
  18. Block File Extensions
  19. Path Traversals
  20. Leverage Security Tools - eg Fixinator, etc.


coldfusion security presentations

ColdFusion Summit 2024 Slides: 20 ways to secure CF was first published on October 04, 2024.

If you like reading about coldfusion, security, or presentations then you might also like:

Fixinator

The Fixinator Code Security Scanner for ColdFusion & CFML is an easy to use security tool that every CF developer can use. It can also easily integrate into CI for automatic scanning on every commit.


Try Fixinator

CFBreak
The weekly newsletter for the CFML Community


Post a Comment