ColdFusion 2023 Update 26 (Adobe security bulletin APSB26-144) tightens several security behaviours. Most sites need no changes. If your application uses any feature below, review the example and take the action shown.
1. Outbound requests to internal addresses
What changed: ColdFusion now blocks server-side HTTP/HTTPS requests to private networks, link-local addresses and cloud metadata services. This applies to cfdocument, cffeed, cfimage, cfschedule, cfexchange, web service (WSDL/SOAP) and GraphQL clients, among others. Public destinations are not affected.
Example: a page that builds a PDF from an internal API.
<cfdocument format="PDF" src="https://api.internal.example.com/report"> </cfdocument>
If api.internal.example.com resolves to a private address, the request now fails with an error similar to:
This URL is not permitted by the outbound network security policy.
What to do: add the destination to your application's allow list in Application.cfc:
component { this.name = "myapp"; this.security.outboundNetwork = { allowList: ["https://api.internal.example.com"] }; }Allow list entries take the form scheme://host[:port][/path]. Subdomain wildcards are not supported, and CIDR entries such as https://10.0.0.0/24 match literal IP addresses only, not hostnames.
Scheduled tasks
After installation, it is important that you check your scheduled tasks, as the new security policy can affect scheduled tasks that call back to your own site.
Example: a scheduled task that requests https://www.example.com/tasks/cleanup.cfm. If that hostname resolves to a private address from the server, the task request is blocked.
What to do: after the update, confirm each scheduled task still completes. If a task is blocked, add the destination to your application's allow list in Application.cfc (above).
2. WebSocket invoke authentication
What changed: unauthenticated WebSocket connections can no longer invoke ColdFusion component (CFC) methods. The call is not run and the client receives an error.
Example: a public chat page where anonymous visitors' browsers call a CFC method through a WebSocket channel. After the update, those calls are refused until the connection is authenticated.
What to do: authenticate WebSocket clients before invoking CFC methods. If an application must allow unauthenticated invocation, set the following in Application.cfc (Adobe does not recommend this):
component { this.name = "myapp"; this.wsRequireAuthForInvoke = false; }3. Remote CFC calls
What changed: getters and setters that ColdFusion generates automatically for accessors="true", and closures, can no longer be called remotely. REST endpoints (restPath, produces, httpMethod) are not affected.
Example:
// Person.cfc component accessors="true" { property name="ssn" type="string"; property name="displayName" type="string"; }A remote client calling Person.cfc?method=getDisplayName previously worked. After the update, it is refused.
What to do: declare an explicit remote function that returns only the data clients need:
component accessors="true" { property name="ssn" type="string"; property name="displayName" type="string"; remote string function getPublicName() { return variables.displayName; } }4. cfreport templates
What changed: report templates must have the .cfr extension and be inside the directory tree of the page that calls cfreport. Subreports and direct requests for .cfr files are checked the same way.
Example: for a calling page at /site/admin/invoices.cfm:
Template | Result |
| Allowed |
| Blocked |
| Blocked (wrong extension) |
A blocked template is logged as Report template denied with the reason.
What to do: move templates into the calling page's directory tree. If templates must stay in another location, contact our support team, as that requires a server-level change.
Note: We will not be able to edit this setting on shared servers.
If you require this functionality, a Cloud Server will be required.
5. File upload size limit (MAX_FILE_SIZE)
What changed: the MAX_FILE_SIZE query string parameter can now only lower the upload size limit, not raise it. Values above the server's maximum post size, and zero, negative or invalid values, are ignored and the server limit is used.
Example:
https://www.example.com/upload.cfm?MAX_FILE_SIZE=2000000000
If this value is above the server limit, it is ignored and uploads larger than the server limit fail.
What to do: if your site relied on MAX_FILE_SIZE to accept larger uploads, contact our support team about the server limit.
Note: We will not be able to edit this setting on shared servers.
If you require this functionality, a Cloud Server will be required.
6. Special form fields
What changed: form fields whose names start with __CFTEXT__, __CFSLIDER__ or __CFGRID__, and PDF form field names that ColdFusion translates, can no longer overwrite an existing form field. If they collide, ColdFusion throws CorruptFieldException and returns HTTP 500. Fields that do not collide behave as before.
Example: a form posts a regular field email, plus a __CFTEXT__-prefixed field that ColdFusion translates to email. Previously the second value replaced the first. After the update, the request returns HTTP 500.
What to do: if a form starts returning HTTP 500 after the update, check it for special fields that resolve to the same name as an existing field, and rename one of them.
7. cffeed enclosures
What changed: when cffeed downloads enclosures, only HTTP and HTTPS URLs are accepted (file:// and other schemes are blocked). Enclosures with extensions in the application's blockedExtForFileUpload list are not saved, and the outbound policy in section 1 applies to the enclosure URL and every redirect.
Example:
cffeed( action="read", source="https://news.example.com/rss.xml", properties="meta", query="entries", enclosureDir=expandPath("./downloads") );An enclosure named update.exe is not saved. Depending on ignoreEnclosureError, it is skipped or an error is raised.
What to do: if you need to block additional file types, keep Adobe's default list and add to it. Do not replace it with a shorter list:
component { this.name = "myapp"; this.blockedExtForFileUpload = "AS,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,DMG,EXE,HBXML,JSP,JSPX,JWS,MXML,PHP,SWC,SWS,CLASS,JAR,ASMX,ASHX,SH,BAT,ZIP"; }8. serializeProtoBuf() schema validation
What changed: serializeProtoBuf() rejects schema values that start with @ or -, are absolute paths outside protoPath, or contain path traversal. The error raised is Invalid Schema or path.
Example:
Schema value | Result |
A schema file inside | Allowed |
Inline schema text | Allowed |
| Rejected (path traversal) |
An absolute path outside | Rejected |
| Rejected |
What to do: use a schema file inside protoPath, or pass the schema as inline text.
9. Web service (WSDL/XSD) consumption
What changed: ColdFusion rejects a WSDL or XSD document, including imported documents, if any attribute or text value contains a double quote, a backslash, a carriage return or line feed, another control character (tab is allowed), or */. The error names the element. xsd:pattern values are exempt for double quotes and backslashes. Text inside documentation elements is cleaned rather than rejected.
Example:
<xsd:enumeration value="C:\Temp"/> <!-- rejected: backslash --> <xsd:pattern value="\d+"/> <!-- allowed: xsd:pattern is exempt -->
What to do: if a web service stops loading after the update, check the element named in the error. If the WSDL belongs to a third party, ask them to correct it.
10. Native C++ CFX tags
What changed: ColdFusion now blocks all native C++ CFX libraries unless their path is on a server-level allow list. Java CFX tags are not affected.
Example: a page that calls a C++ CFX tag such as <cfx_MyTag> stops working after the update until its library path is allowed.
What to do: contact our support team with the full path to the library file so it can be reviewed for the server allow list.
Note: We will not be able to edit this setting on shared servers.
If you require this functionality, a Cloud Server will be required.
Known issue: cfdocument and embedded resources
Adobe reports that cfdocument does not yet apply the outbound policy in section 1 to resources referenced inside the HTML it renders, such as <img>, stylesheets, CSS @import, CSS background-image, <iframe> and <object>.
Example: a page renders visitor-supplied comments into a PDF:
<cfdocument format="PDF"> <cfoutput>#form.comments#</cfoutput> </cfdocument>
If a visitor submits <img src="http://169.254.169.254/...">, the renderer can request that internal address and include the response in the PDF.
What to do: until Adobe fixes this, do not render untrusted or user-supplied HTML with cfdocument. Encode it so it is output as text instead:
<cfdocument format="PDF"> <cfoutput>#encodeForHTML(form.comments)#</cfoutput> </cfdocument>