UCF STIG Viewer Logo

The ColdFusion Administrator Console must be hosted on a management network.


Overview

Finding ID Version Rule ID IA Controls Severity
V-62463 CF11-05-000161 SV-76953r1_rule Medium
Description
ColdFusion consists of the Administrator Console and hosted applications. By separating the Administrator Console from hosted applications, the user must authenticate as a privileged user to the Administrator Console before being presented with management functionality. This prevents non-privileged users from having visibility to functions not available to the user. By limiting visibility, a compromised non-privileged account does not offer information to the attacker to functionality and information needed to further the attack on the application server. By hosting the Administrator Console on a management-only network, the console is protected from hosted application users, is isolated to only management devices, is not vulnerable to accidental discovery, and most management networks encrypt all traffic protecting management data from accidental disclosure.
STIG Date
Adobe ColdFusion 11 Security Technical Implementation Guide 2017-12-31

Details

Check Text ( C-63267r1_chk )
Access the Administrator Console through a browser making note of the IP address that is used to access the console. Review the site's network diagram to validate that the IP used is on a management network and is separate from the public network.

If the Administrator Console is not part of a management network, this is a finding.
Fix Text (F-68383r1_fix)
Host the ColdFusion Administrator Console on a management network.