CODEWITHSUNDEEP
coldfusioniis-7.5
Steve
Steve

Reputation: 3095

Missing template errors with strange path shown

This is not ColdFusion specific, but the server is ColdFusion 10 on Windows Server.

About once a day I'll get a log file of a string of missingtemplate errors, and I can't figure out if this is a typo somewhere on my part, or a user doing something, or some sort of exploration exploit.

The most recent one from last night doesn't seem like it affects the user, as by following CGI.QUERY_STRING I can see they come to the home page, hit our login_action.cfm page to log in, get into the logged in area and then again following the CGI.QUERY_STRING I can see what pages they were on by the URL variables.

The missing template target page argument is always this:

TARGETPAGE  /https:/secure.domain.com/index.cfm

Which shows this for path translated and script name

PATH_TRANSLATED D:\web\site\https:\secure.domain.com\index.cfm 
SCRIPT_NAME /https:/secure.domain.com/index.cfm

After she logs in I can see by the CGI dump that she is indeed logged in OK

PATH_TRANSLATED D:\web\site\https:\secure.domain.com\user\login\index.cfm

Under the query_string I'll be able to see what pages she's on with ?p=home, ?p=editaccount (URL would be index.cfm?p=home etc.)

I don't believe this is malicious, nothing is exposed to the user as far as error reporting, but nonetheless I'd like to figure out why / how this happens about once per day on this application, and understand how it does not seem to effect the user on the site yet throws these missingtemplate errors.

Upvotes: 0

Views: 137

Answers (1)

Jules
Jules

Reputation: 2021

You may have a malformed link somewhere in your app.

Look at the referrer of the error page, then inspect that previous page on the client side (as a user).

Also look at the user agent. It could be a browser trying to pre-fetch pages - and I'm assuming one is from a malformed link.

Upvotes: 1

Related Questions