ColdFusion Robust Exception Information Enabled: How to Find and Fix This Production Risk

Robust Exception Information is a ColdFusion debugging setting that, when enabled, makes error pages display a dangerous amount of internal detail - and leaving it on in production is a well-known information-disclosure risk that security scanners flag as a vulnerability. Per Adobe's own documentation, when Robust Exception Information is enabled the ColdFusion exception error page shows four specific things: (1) the path and URL of the page that caused the error, (2) the line number and a short snippet of the actual code where the error occurred, (3) any SQL statement and the data source name, and (4) the full Java stack trace. That's path disclosure and partial source-code disclosure handed to anyone who can trigger an error - often just by submitting a malformed parameter. The good news: it's cleared by default, and the fix is a single checkbox. The catch: developers enable it while troubleshooting and forget to turn it off, so it quietly ends up live. To find it, check ColdFusion Administrator → Debugging & Logging → Debugging Settings (or scan with Foundeo's Hack My CF / Fixinator); to fix it, clear the "Enable Robust Exception Information" checkbox, and replace it with a custom error handler that logs detail server-side while showing users a friendly page. This guide covers exactly what leaks, how to find it, and how to fix it for good.
Read More