V-279071

Discussion

Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages must be carefully considered by the organization and development team. The release of Tomcat that comes with ColdFusion can be configured to output Tomcat-specific debug messages. If left enabled, these settings can expose sensitive data within error and log messages.

Check Content

Review the debug parameter for the DefaultServlet and verify it is disabled.

1. Locate the web.xml file for each ColdFusion instance located at:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

2. Open the web.xml file in a text editor.

3. Search for the following servlet definition:

<servlet>
  <servlet-name>default</servlet-name>
  <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>

4. Within this block, locate the <init-param> with the <param-name>debug</param-name> element.

5. Verify the corresponding <param-value> is set to 0. For example:
<init-param>
  <param-name>debug</param-name>
  <param-value>0</param-value>
</init-param>

If the debug parameter is set to any value other than 0, or is not explicitly defined, this is a finding.