V-279091

Discussion

Setting a nonzero timeout for web services is crucial to prevent indefinite waiting periods that can lead to resource exhaustion and potential denial-of-service (DoS) attacks. Without a timeout, web services may hang indefinitely, consuming server resources and potentially causing ColdFusion to become unresponsive. By configuring a nonzero timeout, the server can terminate stalled web service requests, ensuring that resources are freed up and the server remains available to handle new requests efficiently.

Check Content

Verify web services timeout.

1. From the Admin Console Landing Screen, navigate to Data & Services >> Web Services.

2. For each Active ColdFusion Web Services:

a. Click "Edit".

b. Review the "Timeout" for each of the "Active ColdFusion Web Services" entries. 

If any of the timeout values are set to 0, this is a finding.