ColdFusion must have the Default ScriptSrc Directory set to a non-default value.

From Adobe ColdFusion 11 Security Technical Implementation Guide

Associated with: CCI-000366

SV-76933r1_rule ColdFusion must have the Default ScriptSrc Directory set to a non-default value.

Vulnerability discussion

The scripts directory contains common javascript code that may be used by the hosted applications. This code is offered to help the developer with common data controls and functions aiding in the quick development of applications. Unfortunately, this code has also been known to have security vulnerabilities. Because of this, many of the ColdFusion hacking tools look for this directory in the default location searching for files with known vulnerabilities. By moving the directory to a non-default location, the hacking tools are unable to find the directory making it more difficult for the attacker.

Check content

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If the "Default ScriptSrc Directory" is set to /CFIDE/scripts/", this is a finding.

Fix text

Navigate to the "Settings" page under the "Server Settings" menu. Enter the new location for the ScriptSrc Directory.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.