title: Fix for Unicode Transformation Issue/Vulnerability in ColdFusion
body: <p>We upgraded our security scanner recently, and it's reporting a new issue.</p>
  
  <p>What's the recommended fix? (We happen to be on ACF9.)</p>
  
  <p>(Also, if you have an example exploit geared to CF, I'd appreciate it.)</p>
  
  <hr>
  
  Unicode transformation issues
  
  <p>Severity</p>
  
  <p>High</p>
  
  Type
  
  <p>Configuration</p>
  
  Reported by module
  
  <p>Scripting (XSS.script)</p>
  
  Description
  
  <p>This page is vulnerable to various Unicode transformation issues
  such as Best-Fit Mappings, Overlong byte sequences, Ill-formed
  sequences.</p>
  
  <p>Best-Fit Mappings occurs when a character X gets transformed to
  an entirely different character Y. In general, best-fit mappings
  occur when characters are transcoded between Unicode and another
  encoding.</p>
  
  <p>Overlong byte sequences (non-shortest form) - UTF-8 allows for
  different representations of characters that also have a shorter
  form. For security reasons, a UTF-8 decoder must not accept
  UTF-8 sequences that are longer than necessary to encode a character. For example, the character U+000A (line
  feed) must be accepted from a UTF-8 stream only in the form
  0x0A, but not in any of the following five possible overlong
  forms:</p>
  
  <ul>
  <li><p>0xC0 0x8A</p></li>
  <li><p>0xE0 0x80 0x8A</p></li>
  <li><p>0xF0 0x80 0x80 0x8A</p></li>
  <li><p>0xF8 0x80 0x80 0x80 0x8A</p></li>
  <li><p>0xFC 0x80 0x80 0x80 0x80 0x8A</p></li>
  </ul>
  
  <p>Ill-Formed Subsequences As REQUIRED by UNICODE 3.0, and noted in the
  Unicode Technical Report #36, if a leading byte is followed by an
  invalid successor byte, then it should NOT consume it.</p>
  
  Impact
  
  <p>Software vulnerabilities arise when Best-Fit mappings occur. For
  example, characters can be manipulated to bypass string handling
  filters, such as cross-site scripting (XSS) or SQL Injection filters,
  WAF's, and IDS devices. Overlong UTF-8 sequence could be abused to
  bypass UTF-8 substring tests that look only for the shortest possible
  encoding.</p>
  
  Recommendation
  
  <p>Identiy the source of these Unicode transformation issues and fix them.
  Consult the web references bellow for more information.</p>
  
  References
  
  <p><a href="http://www.blackhat.com/presentations/bh-usa-09/WEBER/BHUSA09-Weber-UnicodeSecurityPreview-PAPER.pdf" rel="nofollow">Unicode
  Security</a></p>
  
  <p><a href="http://www.cl.cam.ac.uk/%7Emgk25/unicode.html" rel="nofollow">UTF-8 and Unicode FAQ for
  Unix/Linux</a></p>
  
  <p><a href="http://sirdarckcat.blogspot.ro/2009/10/couple-of-unicode-issues-on-php-and.html" rel="nofollow">A couple of unicode issues on PHP and
  Firefox</a><a href="http://www.unicode.org/reports/tr36/" rel="nofollow"></a></p>
  
  <p><a href="http://www.unicode.org/reports/tr36/" rel="nofollow">Unicode
  Security Considerations</a></p>
  
  Affecteditems
  
  <p>/mysite-portal/</p>
  
  <p>Details</p>
  
  <p>URL encoded POST input linkServID was set to
  acu5955%EF%BC%9Cs1%EF%B9%A5s2%CA%BAs3%CA%B9uca5955</p>
  
  <p>List of issues:</p>
  
  <ul>
  <li><p>Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9)
  was transformed into U+0027 APOSTROPHE (')</p></li>
  <li><p>Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9)
  was transf ... (line truncated)</p></li>
  </ul>
  
  <p>Request headers</p>
  
  <p>GET</p>
  
  <p>/mysite-portal/?display=login&amp;status=failed&amp;rememberMe=0&amp;contentid=&amp;LinkServID=acu5955%1
  Cs1es2%BAs3%B9uca5955&amp;returnURL=<a href="https://stage-cms.mysite.com/mysite-portal/" rel="nofollow">https://stage-cms.mysite.com/mysite-portal/</a>
  HTTP/1.1 Referer: <a href="https://stage-cms.mysite.com:443/" rel="nofollow">https://stage-cms.mysite.com:443/</a></p>
  
  <p>Connection: Keep-alive</p>
  
  <p>Accept-Encoding: gzip,deflate</p>
  
  <p>User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
  Trident/5.0)</p>
  
  <p>Accept: */*</p>
  
  <p></p>
  
  <p>Host: stage-cms.mysite.com</p>
  
  <p></p>