ColdFusion Deployment Secrets Exposed in Terraform State
Plaintext by Design: Getting ColdFusion Secrets Out of Your Terraform State
An auditor asks to see your Terraform state file. Someone opens it, searches for “password,” and finds the production ColdFusion datasource credential sitting there in readable text. Alongside it is the ColdFusion administrator password, because a provisioning script needed it.
Comments
Post a Comment