ColdFusion Posts Around the World
Pete Freitag
I've had a few questions lately about Tomcat CVE-2025-24813 vulnerability. There are two potential issues at hand, but both have the requirement:
"writes enabled for the default servlet (disabled by default...
Pete Freitag
Today I was trying to load a -javaagent on Java 21 / ColdFusion 2025 on Windows Server 2022, but I was getting the following error:
Error occurred during initialization of VM
Could not find agent library instrument on the library path, with error: Can't find depende...
Pete Freitag
I'm extremely pleased to announce the release of Fixinator version 6.0.0!
Last year in 2024, there were 7 releases to the Fixinator scanning engine. Version 6.0.0 marks the second release of 2025 already! Thanks to the many customers of Fixinator over the past few years it continues to i...
Pete Freitag
In case you missed it, Adobe released ColdFusion 2025 last week. The ColdFusion 2025 release has removed several deprecated or unsupported features, so it is important to test your code, and scan your code for these issues before updating. You can find Adobe's list of deprecated and removed feat...
Pete Freitag
Upgrading to the latest version of ColdFusion can be stressful. What will break? What might start to act differently? While Adobe generally prioritizes backward compatibility, there are always nuances to consider. For instance did you know that the meaning of the D date mask character changed i...
Pete Freitag
This year at the Adobe ColdFusion summit in Las Vegas I presented on 20 ways to secure ColdFusion. You can download my slides here.
When giving a presentation on security there are certain topics t...
Pete Freitag
I am going to attempt to keep this page updated with the latest ColdFusion Security Updates and Hotfixes published by Adobe. This will allow me to update this page as more info becomes available about updates. I will also try to back fill this so it has past info as well.
September 2024...
Pete Freitag
Here's something I learned recently: you can pass negative values into the left() and right() functions in CFML. Thanks to John Whish for pointing this out in a pull request on cfdocs.org.
The left() and right() functions work great for...
Pete Freitag
Last week's Adobe ColdFusion security update disabled searchImplicitScopes by default. Prior to that update, and for the past twenty five years, ColdFusion would search through the all the possible scopes until it found a ma...
Pete Freitag
Adobe has published a ColdFusion Security Hotfix APSB24-14 today which describes "a critical vulnerability that could lead to arbitrary file system read".
One of the things you will want to take...
Pete Freitag
Last week security researchers from Project Discovery published details on three Lucee vulnerabilities:
A Remote Code Execution (RCE) on isDefined, StructGet, Empty functions
...
Pete Freitag
A few months ago I was on a mission to remove some of the old broken links on my blog. I started blogging back in 2002, so many of the sites that I linked to twenty years ago were no longer active, or no longer under the same ownership. I decided to start this task by weeding out any domains tha...
Pete Freitag
Removing the Server Header as of IIS 10 (the version of IIS installed by default on Windows Server 2016, 2019 or 2022) is now much easier than it had been with prior versions of IIS. By default IIS will return a HTTP response header like this:
Server: Microsoft-IIS/10.0
This te...
Pete Freitag
When setting up a server for training purposes I wanted to create a self signed certificate for app1.example.com and trust it in Edge on Windows Server 2022.
Normally when I create a self signed certificate on Windows Server I just use the IIS Server Certificates button C...
Pete Freitag
When setting up a server for training purposes I wanted to create a self signed certificate for app1.example.com and trust it in Edge on Windows Server 2022.
Normally when I create a self signed certificate on Windows Server I just use the IIS Server Certificates button C...
Pete Freitag
I ran into a really strange problem today, whenever I would write a file it would show up as empty on my file system.
Here's a simplified version of my code:
var nl = chr(13);
var csv = '"order_id","date"' & nl;
csv &= '"1","2023-01-01"' & nl;
fileWrite("/tmp/test.tx...
Pete Freitag
I ran into a really strange problem today, whenever I would write a file it would show up as empty on my file system.
Here's a simplified version of my code:
var nl = chr(13);
var csv = '"order_id","date"' & nl;
csv &= '"1","2023-01-01"' & nl;
fileWrite("/tmp/test.tx...
Pete Freitag
The Adobe ColdFusion Summit is coming up in October. I will be speaking at the conference, and my company Foundeo is also one of the conference sponsors.
As part of the sponsorship I have an extra entry ticket to CFSummit that I am going to give away to ...
Pete Freitag
The Adobe ColdFusion Summit is coming up in October. I will be speaking at the conference, and my company Foundeo is also one of the conference sponsors.
As part of the sponsorship I have an extra entry ticket to CFSummit that I am going to give away to ...
Pete Freitag
I'm back from Houston Texas after another great Into the Box conference. Slides for my talk Taming the top 25 Most Dangerous Software Weaknesses
Pete Freitag
I'm back from Houston Texas after another great Into the Box conference. Slides for my talk Taming the top 25 Most Dangerous Software Weaknesses can be found here. For code samples I used my
Pete Freitag
Today I needed to get the time that a file was created from within some CFML code. I had first thought that cfdirectory or directory...
Pete Freitag
Today I needed to get the time that a file was created from within some CFML code. I had first thought that cfdirectory or directoryList would return this, but it only returns the date the a file was modified, not the date that it was created.
My next thought was...
Pete Freitag
I will be giving my talk Taming the Top 25 Most Dangerous Software Weaknesses (for ColdFusion Developers) next Tuesday, December 6th 2022 at 1
Pete Freitag
I've had a several people asking me about the openssl vulnerabilities that were patched this week: CVE-2022-3602 and CVE-2022-3786 aka Spooky SSL
Pete Freitag
Early bird registration is open for my ColdFusion Security Training deep dive c
Pete Freitag
Someone asked on the CFML slack recently how can you find out how long your ColdFusion (or Lucee) server has been running via code.
How
Pete Freitag
CloudFlare recently released a new CAPTCHA service called Turnstile, which aims to provide a better user experience for CAPTCHA's. At the wors
Pete Freitag
I'm back from another excellent CFSummit. So many great presentations and conversations. This year I gave a presentation on the 25 Most Dangerous S
Pete Freitag
Code is complex, so any static application security testing (SAST) tool will find things that may not be an actual security issue.
Pete Freitag
A really handy feature of the arrayEach() function is the parallel argument. It has been suppor
Pete Freitag
The uuid() function in MySQL returns a 36 character hex string, formatted as:
aa479ea9-1d9d-11ed-ba03-564760fe47b7
ColdFusio
Pete Freitag
I gave a presentation for the Adobe ColdFusion Developer Week Conference today titled: Better CFML Code with CI. You can find the
Pete Freitag
I'm probably not the first one to notice this, but if you have a hosts file (eg /ect/hosts or c:\windows\system32\drivers\etc\hosts
Pete Freitag
This question came up recently:
How do you read a stack trace?
Are there any resources that will educate me?
While the
Pete Freitag
It is rare that a simple JVM argument change can have a dramatic impact on execution times, but in the case of AWS Lambda adjusting the Tiered Comp
Pete Freitag
I've had a bunch of people ask me if ColdFusion / Lucee servers need to worry about the recent Java vulnerability in Spring, nick named Spring4Shel
Pete Freitag
If you have a column that may contain NULL values, and you want sort on that column with an ORDER BY clause, which comes firs
Pete Freitag
If you are using CloudFlare in front of your web server, it is a good idea to setup
Pete Freitag
Almost every day I see someone asking what to do about log4j 1.2 / 1.x versions. It can be quite a lot of wrap your head around, and it can't be answer...
Pete Freitag
When I created a blog entry covering Log4Shell log4j on ColdFusion, and said I would update it a
Pete Freitag
Here's how you can get the version of Log4j you are using at runtime using Java:
Java Code to Get the Log4j Version at Runtime
Pete Freitag
There is a critical security vulnerability (CVE-2021-44228 aka Log4Shell) in the java library log4j which is a popular logging library for java applica...
Pete Freitag
Here's a quick code snippet that will output a list of OSGI java bundles and bundle versions that are loaded / installed on Lucee:
//CFMLEngi
Pete Freitag
While looking at the PageSpeed Insights for my blog I noticed that the Twitter widgets I was using to display a twitter follow button and a tw
Pete Freitag
A few years ago I gave a presentation to my local CFUG titled Docker for Devs. I recently realized that I never posted the slides or the examp
Pete Freitag
It was great to be a speaker at the ColdFusion DevWeek event last week. I spoke on the topic Securing ColdFusion Applications.
As promi
Pete Freitag
What versions of Java support TLSv1.3 / TLS 1.3?
Java 8 TLS 1.3 Support
If you are on Java 8 (or 1.8 if you prefer) then you need versi
Pete Freitag
ColdFusion / CFML has a builtin function that can convert a string or a binary object to a standard Base64 encoded string:
Pete Freitag
The OpenJDK Crypto Roadmap states that TLSv1 and TLSv1.1 will be disabled in OpenJDK relea
Pete Freitag
Here's a bash script that uses osquery to log which files in a specific folder have been modified over a 15 minute period. My use case her
Pete Freitag
Hashicorp Vault is an open source, enterprise grade security vault. It is designed to grant secure access to the secrets that it stores. It can also act as an encryption as a service API. Vault is very powerful, and there are lots of resources and videos describing how it works.
Using Vault is somet...
Pete Freitag
The builtin CFML function sessionInvalidate() works great for invalidating or clearing a ColdFusion session (CFID/CFTOKEN). But it doesn't invalidate the underlying J2EE / JEE session (the JSESSIONID).
You can dip down into the underlying JEE API and invoke the invalidate() function on the javax.ser...
Pete Freitag
Jakob Ward recently posted an interesting question to the CFML slack channel:
Is there a point to setting maxlength for a timestamp value in cfqueryparam? Or can this be ignored safely?
My guess was that cfqueryparam would ignore the maxlength attribute when the cfsqltype is timestamp (or cf_sql_t...
Pete Freitag
People often download and install the latest version of Java, rather than the latest LTS version of java. In most cases, especially if it is on a server you probably want to be using the LTS version of java.
So what is a Java LTS Version?
LTS stands for Long Term Support, this means that the java ve...
Pete Freitag
Thanks to all who attended my talk today on Securing ColdFusion Applications. You can find the slides here.
Many had asked me about the link to ColdFusion Security Training class to be held on Thursday December 10, 2020 @ 11am-2pm & Friday December 11 @ 11am-2pm
(Eastern Standard Time, UTC -5). In t...
Pete Freitag
It would be nice if Windows Server 2019 came with Microsoft Edge Browser, but it still comes with good old IE 11, and on a Windows Server, you have to jump through hoops to let IE download anything due to its default security settings.
First I tried downloading Microsoft Edge Browser with IE on Wind...
Pete Freitag
Here is a handy trick I saw in some code recently. It turns out you can use a negative integer in the count argument of the left() and right() functions in CFML. This works in multiple versions of both Lucee and Adobe ColdFusion!
Here's an example:
left("Peter", -1)
This will trim 1 character off th...
Pete Freitag
One of the recent changes to Lucee is that no longer allows you to enter an admin password from the web based lucee admin if one had not been set yet. This is a great feature for security, but for local development it makes things a bit more cumbersome.
You'll see what I mean when you hit this error...
Pete Freitag
I've been using CommandBox to startup CF servers on my dev laptop and desktop for several years, maybe even since the first version was released! CommandBox does a great job of hiding its internal magic, and thus the amount of disk space it consumes can creep up on you. To make matters worse it stor...
Pete Freitag
One thing I've had to google more times than I'd like to admit is the path argument order for the ln command. What comes first in the ln -s command on linux or Mac? So I thought I'd write a little blog entry for future me to find.
Here's an example:
ln -s /real/path /linked/path
To answer my own que...
|
