Ben Forta

Someone posted a message on cf-talk today that quickly mushroomed into a discussion on shared hosting and the related security risks. There is nothing wrong with shared hosting, and for many applications shared hosting may be the right choice (due to the low cost). But such an environment does have inherent security risks, and it is important to understand them.
Unless you are running ColdFusion on top of a J2EE server (more on that in a moment), computers run a single copy of ColdFusion. This is true of all versions of ColdFusion, starting with CF1 all the way through CFMX.
What does this mean? Several things. For starters, the performance of any application is affected by the performance of any other, if someone were to write really bad CF code that slowed his or her application, your application will suffer too. In addition, settings are shared (debugging settings, caching settings, timeouts, global error handlers, etc.). This will likely mean that when you ask for a CF Admin setting to be changed for you, you’ll be told “no”. Furthermore, when an update or service pack comes out, you’ll probably have to wait to be able to use it – your ISP will generally need to be extremely conservative when it comes to making any configuration changes. And you can forgot asking for a service to be restarted when the need arises.
All of these may or may not be valid concerns, but they are not the really big concern. The really big concern is security. On a shared box resources are shared. Data sources defined for one application may be used by another. Files and directories belonging to one application may be accessed by anyone with access to and . Even scopes may be shared.
At a high level there are two ColdFusion features that can help with the problem, or rather, can help with different parts of the problem. One option is to disable the use of “dangerous” tags. I know of lots of ISPs who do not allow the use of , , , and other tags too. And while I appreciate that turning off the use of these tags can help, I do not like this option at all. For starters, it is unfair to users to prevent them from being able to use the language elements they want. In addition, it creates a false sense of security, as if somehow this solves the whole problem. I personally would never host with an ISP who imposed language restrictions on me. Another security option is to use sandboxes, this allows an ISP to lock down CF activity by directory structure, so that applications in specific directories have access to their data sources and files but not others, and perhaps even allowing some applications to use CFML language elements that others may not. This does not solve all security problems, but it does help quite a bit. Sandboxes were introduced in CF4, but they only became easy to use in CFMX. As such, many ISPs don’t use them. My advice would be that if ISPs won’t use sandboxes, then you don’t use them.
Beyond all this, there is another risk, and there is no solution for this one in a shared hosting environment. As already said, all applications share the same ColdFusion. Stuff in the SERVER scope (which you generally should not be using anyway) is shared by all applications. Stuff in APPLICATION is shared by all instances of the same . Stuff in SESSION is shared by all requests containing the same session identifiers. So if two applications have the same then they will share an APPLICATION scope. This mean that if a malicious user were to learn your then they could change your APPLICATION scope variables. There is no way around that one in a shared instance. It’s one of the risks you have to take when using a shared ColdFusion server.
Having said all this, shared hosting is not a bad thing, but it is inherently risky (this is nothing to do with CF, if you were using ASP or PHP or Perl or whatever it would be just as risky). Sites that need high security and high availability and complete control should not be using shared hosting, they need dedicated hosting. In the past this meant a dedicated box, but this is not the case anymore. Using ColdFusion on top of a J2EE server it is now possible to have multiple instances of ColdFusion in the same box. For the right clients and applications, this is the only really safe way to implement shared hosting.