2

I'm probably just being paranoid again about security. The latest thing keeping me up at night is the checks that one of our websites uses. It runs ColdFusion 9 on windows environment and we check a user input by isNumeric to verify that a string or input it is indeed a number. If it isn't a number stop execution and show message to user, else do what needs to be done normally. My question is, is there a way to break this check? Basically some kind of format that isNumeric will report as a number but can actually include something bad?

<cfparam name="userInput" default="0">
<cfif isNumeric(userInput)>
    // Should be a number id 500
    // Use value to do SQL stuff because should be number
    // I know, not the best practice. Plan to fix all of these but the 
    // amount of code is staggering to fix all of these. Figured 
    // start with one thing then move on
    <cfquery>
       SELECT * FROM db WHERE serial = #userInput#
    </cfquery>
<cfelse>
    // Not a number ie '500sws'
</cfif>

Is there something that can be passed into userInput that can fool it to report true but actually not be?

Reason why I'm asking is cause this site is old. Things are out dated. I'm in process of working my way through a really large amount of code and there are points of vulnerability that I will be fixing as I go but if isNumeric can be fooled, then I have more work to do.

Not sure if I'm explaining it right. Let me know if there needs to be clarification.

If this need to be moved else where let me know. My last security question I asked ended up here so I decided best to try here first. Thanks every one.

  • Not a bad question, but you might get better traction on stackoverflow. – Steve Mar 7 '17 at 20:02
  • That's what I thought, but I figured security related, best start here. – jkw4703 Mar 7 '17 at 20:03
  • 1
    Depends on the implementation of isNumeric(). I would Need to test it, but perhaps it uses some old C runtime functions under the hood to do the job. If so, then in this case it might be possible to add some arbitrary string data behind a valid number. Anyway, to be sure, if this method give you TRUE you should force the convert operation before using it in your query and then you should be safe. – David Julitz Mar 9 '17 at 10:13
1

Im not able to test it for CF9, because this Version is too old and not easy available anymore. To be 100% sure you should force the convert to a number before using it. For example (untested).

<cfquery>
   SELECT * FROM db WHERE serial = #Val(userInput)#
</cfquery>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.