Public functions become remotely accessible when implementing onCFCRequest()

Question

SOME BACKGROUND:

I'm using onCFCRequest() to handle remote CFC calls separately from regular CFM page requests. This allows me to catch errors and set MIME types cleanly for all remote requests.

THE PROBLEM:

I accidentally set some of my remote CFC functions to public access instead of remote and realized that they were still working when called remotely.

As you can see below, my implementation of onCFCRequest() has created a gaping security hole into my entire application, where an HTTP request could be used to invoke any public method on any HTTP-accessible CFC.

REPRO CODE:

In Application.cfc:

    public any function onCFCRequest(string cfc, string method, struct args){
        cfc = createObject('component', cfc);
        return evaluate('cfc.#method#(argumentCollection=args)');
    }

In a CFC called remotely:

    public any function publicFunction(){
        return 'Public function called remotely!';
    }

QUESTION:

I know I could check the meta data for the component before invoking the method to verify it allows remote access, but are there other ways I could approach this problem?

Answer 1

onCfcRequest() doesn't really create the security hole, you create the security hole by blindly running the method without checking to see if it's appropriate to do so first, I'm afraid ;-)

(NB: I've fallen foul of exactly the same thing, so I'm not having a go @ you ;-)

So - yeah - you do need to check the metadata before running the method. That check is one of the things that CF passes back to you to manage in its stead when you use this handler, and has been explicitly implemented as such (see 3039293).

I've written up a description of the issue and the solution on my blog. As observed in a comment below I use some code in there - invoke() - that will only work on CF10+, but the general technique remains the same.