title: CF10 websocket p2p can invoke any public functions in any CFC from JavaScript. How is this Not a security risk?
body: <p>In <a href="http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d318518767eb3aa135858633ee-7fed.html" rel="noreferrer">Using WebSocket in point-to-point communication</a> in Adobe ColdFusion 10 Dev Guide, the javascript object <code>mysocket</code> created by <code>&lt;cfwebsocket&gt;</code> can call an <a href="http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d318518767eb3aa135858633ee-7fef.html" rel="noreferrer"><code>invoke()</code></a> method that can literally invoke Any public method on Any CFC from JavaScript.</p>
  <p>How is this <strong>Not</strong> a security risk?  How shall a cfc / function protect against being invoked by websocket?</p>
  <blockquote>
  <p><strong>1. Create a CFM page index.cfm.</strong></p>
  <pre><code>&lt;script type=&quot;text/javascript&quot;&gt; 
         function msgHandler(msgobj){ 
             var txt = document.getElementById(&quot;myDiv&quot;); 
             var message = ColdFusion.JSON.encode(msgobj); 
             txt.innerHTML += message + &quot;&lt;br &gt;&quot; + &quot;&lt;br&gt;&quot;; 
         } 
         function invokecfcfn(){ 
                var fname= document.getElementById(&quot;fnname&quot;).value; 
                if (fname == &quot;f2&quot;) { 
                       alert(&quot;f2 selected&quot;); 
                       mysocket.invoke(&quot;mycfc&quot;, &quot;f2&quot;, [&quot;echo&quot;]); 
                } 
                else 
                       mysocket.invoke(&quot;mycfc&quot;, fname); 
                
         } 
  &lt;/script&gt; 
  &lt;cfwebsocket name=&quot;mysocket&quot; onmessage=&quot;msgHandler&quot;/&gt; 
  &lt;form&gt; 
         &lt;select id=&quot;fnname&quot;&gt; 
                &lt;option&gt;f1&lt;/option&gt; 
                &lt;option&gt;f2&lt;/option&gt; 
                &lt;option&gt;f3&lt;/option&gt; 
         &lt;/select&gt; 
         
         &lt;input id=&quot;invokefn&quot; name=&quot;invokefn&quot; value=&quot;Invoke CFC function &quot; type=&quot;button&quot;  onclick=&quot;invokecfcfn();&quot;&gt; 
         &lt;div id=&quot;myDiv&quot;&gt; 
         &lt;/div&gt; 
  &lt;/form&gt;
  </code></pre>
  <p><strong>2. Create a CFC mycfc.cfc that contains the function called from the client page.</strong></p>
  <pre><code>&lt;cfcomponent&gt; 
         
         &lt;cffunction name=&quot;f1&quot; &gt; 
                &lt;cfreturn &quot;Message returned from f1&quot;&gt; 
         &lt;/cffunction&gt; 
         
         &lt;cffunction name=&quot;f2&quot; returntype=&quot;string&quot; &gt; 
                &lt;cfargument name=&quot;arg1&quot; type=&quot;string&quot; required=&quot;true&quot;  &gt; 
                &lt;cfset msg= &quot;Message from wsssendmessage of f2 which you called with arg &quot; &amp; arg1&gt; 
                &lt;cfset wssendMessage(msg)&gt; 
                &lt;cfreturn &quot;Message returned from f2&quot;&gt; 
         &lt;/cffunction&gt; 
         
         &lt;cffunction name=&quot;f3&quot; &gt; 
                &lt;cfthread action=&quot;run&quot; name=&quot;t1&quot; &gt; 
                       &lt;cfloop index=&quot;i&quot; from=&quot;1&quot; to=&quot;10&quot;&gt; 
                             &lt;cfset sleep(20000)&gt; 
                             &lt;cfset wssendMessage(&quot;Message #i# from wsssendmessage of f3 #now()#&quot;)&gt; 
                       &lt;/cfloop&gt; 
                &lt;/cfthread&gt; 
                &lt;cfreturn &quot;Thread initiated in f3&quot;&gt; 
         &lt;/cffunction&gt; 
  &lt;/cfcomponent&gt;
  </code></pre>
  </blockquote>
  <p><strong>EDIT:</strong> not Any function, private function returns:</p>
  <pre><code>{
    &quot;clientid&quot;:39550088,
    &quot;ns&quot;:&quot;coldfusion.websocket.channels&quot;,
    &quot;reqType&quot;:&quot;invoke&quot;,
    &quot;code&quot;:4001,
    &quot;type&quot;:&quot;response&quot;,
    &quot;msg&quot;:&quot;The method f1 was not found in component mycfc.cfc.&quot;
  }
  </code></pre>
  <p><strong>UPDATE:</strong></p>
  <p>I tried moving <code>mycfc.cfc</code> to <code>/com</code> (outside of webroot) and added a mapping to <code>/com</code> and the functions can <em>STILL</em> be successfully invoked.</p>
  <p><strong>UPDATE: July 3, 2013</strong></p>
  <blockquote>
  <p>The Adobe Product Security Incident Response Team (PSIRT) is aware of
  this issue and is actively engaged with the ColdFusion Product Team to
  release a fix.</p>
  </blockquote>
  <p><a href="http://blogs.coldfusion.com/post.cfm/coldfusion-10-websocket-vulnerebility" rel="noreferrer">http://blogs.coldfusion.com/post.cfm/coldfusion-10-websocket-vulnerebility</a></p>
  <p><strong>UPDATE: July 9, 2013</strong></p>
  <blockquote>
  <p>Adobe has released a security hotfix for ColdFusion 10 for Windows,
  Macintosh and Linux.  This hotfix addresses a vulnerability
  (CVE-2013-3350) that could permit an attacker to invoke public methods
  on ColdFusion Components (CFC) using WebSockets.</p>
  </blockquote>
  <p><a href="http://www.adobe.com/support/security/bulletins/apsb13-19.html" rel="noreferrer">http://www.adobe.com/support/security/bulletins/apsb13-19.html</a></p>