The document discusses code review of a university's 17,394 ColdFusion source files developed by various skilled and unskilled developers. An initial review found issues like arbitrary file uploads, SQL injection in 29 apps, and XSS vulnerabilities in 33 apps. The review was conducted by recruiting cybersecurity students to examine the code. Most developers were willing to fix issues when notified. The university also implemented security training for developers and embedded automated code review tools to improve security going forward.

1. Code review

2. Code Review
Richard Fuller, University of York
richard.fuller@york.ac.uk

6. The Problem
 17,394 ColdFusion source files
 Many hacked together in place
 Variety of skilled and unskilled developers
– Many of whom don’t work here anymore
 Mostly no test versions
– Not allowed to poke things (unlike attackers)

7. OWASP Top 10
 Provides a focus for training and review
 Initial focus on:
– Code execution
– SQL injection
– XSS

8. Methodology
 Track third level directories in a huge Google Sheet
– Owner
– Reviewer
– Most serious exploit
– Status
 “Code Review” day
 No automated code review tools for ColdFusion, so…

10. Mechanical Turk
 Recruited students on the Cyber Security MSc
 Can quickly teach someone to spot flaws in ColdFusion
– “ColdFusion for Pentesters”
– “Deconstructing ColdFusion”
 Decidedly more challenging with complex Java apps
 Inability to recreate environment
– Makes fixing harder

11. What did we find?
 Arbitrary file upload
– Additional misconfiguration allowing access to all web scripts and
DB passwords
 29 “apps” with SQL injection (mix of public and authenticated)
 33 with XSS (mix of stored and reflected)
 A few “generate arbitrary e-mail” scripts
 Downloadable source code with passwords in (wrong extension,
zip files, etc.)
 Username stored in cookies

12. What will you find?

13. What will you find?
 Spoiler: It’s not going to be that different

14. Really serious stuff
 Disable code
 Fix web server config

15. Competent responsible owner
 Let the owner know a breakdown of the issues
 Offer them our training course
 Meet up with people
– People start coming to you

16. Everything else
 Asking people to fix their code? No.
 Asking if we could fix their code? No.
 Promising to remove their code in two weeks? Sort of.
– Surprisingly little resistance
– Or consequence

17. Webapp Security Training
 Full day course offered to developers across the
University
 Theory and practical “hacking” exercises
– DVWA running in VirtualBox
– sqlmap
 Find out what languages used in advanced

19. Embedding code review
 Automated, continuous deployment with Jenkins
 Code review with Review Board
– Helps get more developers familiar with the
code
– Gets two pairs of eyes on security
 Lightweight, but effective

22. Questions?

23. jisc.ac.uk
Contact
Richard Fuller
University ofYork
richard.fuller@york.ac.uk