Mailing-List: contact dev-help@myfaces.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "MyFaces Development" <dev@myfaces.apache.org>
Date: Wed, 16 Aug 2017 13:46:00 +0000 (UTC)
From: "Leonardo Uribe (JIRA)" <dev@myfaces.apache.org>
To: dev@myfaces.apache.org
Message-ID: <JIRA.13094791.1502812439000.43473.1502891160176@Atlassian.JIRA>
In-Reply-To: <JIRA.13094791.1502812439000@Atlassian.JIRA>
References: <JIRA.13094791.1502812439000@Atlassian.JIRA> <JIRA.13094791.1502812439562@jira-lw-us.apache.org>
Subject: [jira] [Commented] (MYFACES-4133) Don't deserialize the
 ViewState-ID if the state saving method is server
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Wed, 16 Aug 2017 13:46:07 -0000


    [ https://issues.apache.org/jira/browse/MYFACES-4133?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D16=
128817#comment-16128817 ]=20

Leonardo Uribe commented on MYFACES-4133:
-----------------------------------------

Encryption should NEVER be disabled for view state token, because there is =
no safe way to make it work with this disabled, but beyond that, I agree se=
rialize the session id is not necessary on server side state saving.=20

Please note encryption also adds a Message Authentication Code (MAC) that p=
rotects the view state token against tampering and other attacks, but this =
works together with the encryption.

It's more, maybe it is a good idea to change the default encryption algorit=
hm to AES or something.

> Don't deserialize the ViewState-ID if the state saving method is server
> -----------------------------------------------------------------------
>
>                 Key: MYFACES-4133
>                 URL: https://issues.apache.org/jira/browse/MYFACES-4133
>             Project: MyFaces Core
>          Issue Type: Bug
>          Components: General
>    Affects Versions: 2.2.12
>            Reporter: Peter St=C3=B6ckli
>
> Currently the ViewState-ID provided by the user is deserialized via Java =
deserialization even when the {{javax.faces.STATE_SAVING_METHOD}} is set to=
 {{server}} (the default).
> The deserialization in this case is unecessary and most likely even slowe=
r than just sending the ViewState Id directly.
> If a developer now disables the ViewState encryption by setting {{org.apa=
che.myfaces.USE_ENCRYPTION}} to {{false}} (against the [MyFaces security ad=
vice|https://wiki.apache.org/myfaces/Secure_Your_Application]) he might hav=
e unintentionally introduced a dangerous remote code execution (RCE) vulner=
ability as described [here|https://www.alphabot.com/security/blog/2017/java=
/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html].
> This has been discussed before on [Issue MYFACES-4021|https://issues.apac=
he.org/jira/browse/MYFACES-4021].


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)