Protect your CF application

7 August 2008 15:02 (EST)

Starting yesterday most of my CF websites are under constant attacks by bots, which are trying to implement SQL injection attack using additional URL parameters.

Since not all applications were developed using CFQUERYPARAM tag and update of all CFQUERY calls will take a long time, simple solution has been developed to block hackers.

Code to be added to your Application.cfm script:

<cfset fName = ExpandPath("/") & "blacklist.txt" />

<cfif isDefined("url.updateapp") or not isDefined("application.blacklist")>
   <cfset application.blacklist = "" />
   <cfif FileExists(fName)>
      <cftry>
         <cffile action="read" file="#fName#" variable="application.blacklist" charset="utf-8" />
         <cfcatch></cfcatch>
      </cftry>
   </cfif>
</cfif>

<cfif ListFind(application.blacklist,cgi.remote_addr,Chr(13)&Chr(10))>
   <cflocation addtoken="false" url="/blacklist.html" />
</cfif>

<cfif FindNoCase("DECLARE",cgi.query_string) and FindNoCase("CAST",cgi.query_string) and FindNoCase("EXEC",cgi.query_string)>
   <cfif not ListFind(application.blacklist,cgi.remote_addr,Chr(13)&Chr(10))>
      <cfset application.blacklist = ListAppend(application.blacklist,cgi.remote_addr,Chr(13)&Chr(10)) />
      <cftry>
         <cffile action="write" file="#fName#" output="#application.blacklist#" charset="utf-8" />
         <cfcatch></cfcatch>
      </cftry>
      <cflocation addtoken="false" url="/blacklist.html" />
   </cfif>
</cfif>

Blacklisting uses three potentially dangerous strings inclusion to URL parameters as a trigger to block ip address: DECLARE, CAST and EXEC.

Blacklist is a plain text file with ip addresses (one per line), replicated into Application scope.

Solution is not 100% ideal, but will prevent hackers from accessing your website.

coldfusion sql application injection attack cfqueryparam security

Discussion (3 comments)

	duncan:	8 August 2008 16:15 (EST)
	That worked pretty well. Haven't had any error reports since I used this script, and it's caught over 660 IP addresses since I installed it about 9 hours ago.
	reply

	RobW:	8 August 2008 23:05 (EST)
	Within 5 minutes of adding this, I already have 2 IP addresses in the blacklist.
	reply

Murray :

17 October 09:21 (EST)

Um... shouldnt that be:

<cfif FindNoCase("DECLARE",cgi.query_string) OR FindNoCase("CAST",cgi.query_string) OR FindNoCase("EXEC",cgi.query_string)>

or am I missing something?
Murray