Protecting Your Lucee Environment: Ensuring Admin Panel Security

In response to a public blog post by a cybersecurity expert about a vulnerability within Lucee environments, a software we use to power our intranet solution, IC has tested a series of updates to mitigate the problem. This impacts customers who have their intranet available over the internet (not just locally inside their network). For more details about the problem reported about Lucee, click here to go to the related blog.  

We recommend taking these three general steps to making your intranet server more secure:

  1. Set more complex passwords for your Lucee Server and Web Administrator panels.
  2. Update Lucee with extensions from the official provider.
  3. Block access to the Lucee Administrator panels when not actively changing configurations.

 

Update your Lucee Server Administrator and Web Administrator passwords

  1. If you have not done so before, take a snapshot of your server before making major changes.
  2. In a web browser, go to the Lucee Server Administrator. The address will consist of your intranet address plus “/lucee/admin/server.cfm”.  For example, https://bestintranet.myintranet.com/lucee/admin/server.cfm
  3. Login with your password.  If you lost your password, please see section “How to reset your Lucee Server password”.
  4. In the left menu, click Password.
  5. Skip this step if you already reset the password in step 3. In the section “Change Password”. Set the server password to a long and secure string of character. Be sure to note this in your password management system.  This is your Lucee server password.
  6. In the section “Set default password”, type in a long and secure password for your web administrator instance(s). Click update. This password will be used in the next step.
  7. In the section “Reset Password”, select your web path from the dropdown menu in the field “Web”. The web path will typically end with “Intranet”. Click “Reset”. This is your Lucee Web password.
  8. In a different browser, try to log in to both the Lucee Server address (/lucee/admin/server.cfm) and Lucee Web Address (/lucee/admin/web.cfm).

If you lost your Lucee Server Admin password, you can reset it:

If you lose your password and get locked out of the Lucee Server Admin you can resolve the issue by following these steps:

    1. Find your lucee-server.xml file. (often located here: C:\sqbox\lucee\tomcat\lucee-server\context\lucee-server.xml)If you can’t find it you may need to do a file search on your server to locate the file.
    2. Locate the line that looks like: <cfLuceeConfiguration hspw="08ff01745878248e85425ea046533aa72e5595975c4f40ce85e1bae0ee9619b7" salt="505516A5-3EF1-4F43-8F0B7E0C2336CC91" version="4.5">
    3. Delete the attributes hspw & salt and save the file so that this line looks like this: <cfLuceeConfiguration version="4.5">
    4. Restart the “Apache Tomcat 9.0 Lucee” service from your "Services" control panel.
    5. Create a text file called password.txt and put your new password within it. Nothing else, just 1 line of text with your password.
    6. Place the password.txt file into your "Lucee Context" folder where lucee-server.xml is located.
    7. Go to the Server Admin URL in your browser:  “/lucee/admin/server.cfm”
    8. You will be prompted to import a password file. Click the button to import the password.

Note: If this process doesn't work, then find the lucee-web.xml.cfm file in the Intranet/WEB-INF/lucee folder.  Repeat steps 2 - 8 with this file.

Update Lucee with extensions/applications from the official provider

  1. If you have not done so before, take a snapshot of your webserver.
  2. Set your intranet into maintenance mode, by going to admin > security > maintenance mode and enabling the option.
  3. On the web server, open a browser and go to download.lucee.org.
  4. In the dropdown menu Release (under section History), choose 5.4.5.23. This is the highest supported version as of March 26, 2024. After the page refreshes, click “lucee.jar” to download the file for the updated version of Lucee.
  5. Under extensions, download the versions of extensions corresponding to this table:
    Extension Name Highest compatible version
    SQL Server 12.4.2.jre11
    Lucee Administrator 1.0.0.5
    Hibernate 3.5.5.89
    PDF 1.2.0.10
    Axis 1 Webservices 1.4.0.37
    Image 2.0.0.25
    ESAPI 2.2.4.15
    Compress 1.0.0.15
    Ajax 1.0.0.5
    Form 1.0.0.10
  6. Unblock all the files from the previous two steps in File Explorer
  7. Find the Lucee lib folder on the web server.  Typically, it will be “c:\sqbox\lucee\lib” or “c:\lucee\lib”
  8. Turn off the “Apache Tomcat 9.0 Lucee” service.
  9. Copy the lucee.jar file into the lib folder. Remove any other .jar files from this folder. Start the “Apache Tomcat 9.0 Lucee” service.
  10. Find the “deploy” folder for Lucee. Typically, it will be “c:\sqbox\lucee\tomcat\lucee-server\deploy” or “c:\lucee\tomcat\lucee-server\deploy”.
  11. Copy the extension files into the deploy folder. Wait about 5 minutes.  All the files should disappear from the folder as they are consumed by the Lucee application.
  12. Log into the Lucee Server admin and go to Applications.  The extensions should match the list above.  If there are any other extensions, take note of them, then remove them by clicking the extension and then clicking Uninstall. Your list should look something like this:
  13. Restart the “Apache Tomcat 9.0 Lucee” service then test your application.
  14. Turn off maintenance mode after you complete your testing.

 

Block access to the Lucee Administrator panels

After you apply these changes, you will not be able to access either Lucee Web Admin or Server Admin panels. Important note:  Before applying hotfixes, patches, or upgrades, you must temporarily remove these “deny” sequences.

  1. On the web server, open Internet Information Services Manager (IIS).
  2. Under Connections, click the server’s name.
  3. In the middle pane, double-click Request Filtering. If you don’t see the option for Request Filtering, see the section “How To Enable Request Filtering”.
  4. Under Actions in the right pane, click Deny Sequence.
  5. Enter “lucee/admin/server.cfm”.  Hit OK.
  6. Under Actions in the right pane, click Deny Sequence again.
  7. Enter “lucee/admin/web.cfm”.  Hit OK.

At this point, you should not be able to access either admin panel. To get access again, temporarily remove the “deny” sequences from Request Filtering.

Important note: Always re-apply these “deny” sequences after you have finished your configuration changes in Lucee Admin.

 

How To Enable Request Filtering

If you can’t find the “Request Filtering” icon in your IIS Installation, it’s possible the feature needs to be installed.

  1. On your “Windows Server” open the “Server Manager” console app.
  2. Click Item (2) – Add roles and features.
  3. The “Add Roles and Features” wizard dialog appears. You can click “Next” until you get to the screen called “Select Server Roles”.
  4. Click the triangle next to the “Web Server (IIS)” to expand the options.
  5. Another option called “Web Server” appears under it and you will need to expand this one as well.
  6. Expand the option “Security” to get the list of options we need to enable.
  7. Choose “Request Filtering” from the list and tick the checkbox to enable it.
  8. Click ‘Next’ 2 more times to get to the final screen of the dialog box.
  9. Click “Install” from the choices at the bottom of the dialog box.
  10. Click “Close” to finish the installation and close the dialog box.
  11. Close and then re-open the IIS application to see the Request Filtering option.

Related articles