Bug 623799 - (CVE-2010-2057) CVE-2010-2057 Apache MyFaces: encrypted view state does not include MAC
CVE-2010-2057 Apache MyFaces: encrypted view state does not include MAC
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20100610,reported=20100810,sou...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-12 15:28 EDT by Vincent Danen
Modified: 2015-07-31 02:30 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-06-26 22:14:54 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2010-08-12 15:28:26 EDT
Quoting the upstream bug report [1]:

Both myfaces and mojarra only encrypt the state. What is missing is add a message authentication code (MAC) to the encryption to prevent padding oracle attack. The objective is detect if the received view state has been modified and do not process it, throwing ViewExpiredException.

The problem can be solved if users change to server side state saving, because on the view state only a identifier is sent and no changes on the component tree could be done with this configuration.

The proposed solution was add this new web-config params:

org.apache.myfaces.MAC_ALGORITHM : Indicate the algorithm used to calculate the Message Authentication Code that is added to the view state.

org.apache.myfaces.MAC_SECRET : Define the initialization code that are used to initialize the secret key used on the Message Authentication Code algorithm.

org.apache.myfaces.MAC_SECRET.CACHE : If is set to "false", the secret key used for MAC algorithm is not cached. This is used when the returned SecretKey for mac algorithm is not thread safe.

It was unified security configuration in all branches to works the same. That means, it was included in 1.1.x the property org.apache.myfaces.USE_ENCRYPTION.

Now, if an error occur when the state is encrypted/decrypted, a ViewExpiredException is thrown, but the real exception is logged, to hide information that could be useful to non developers.


This was corrected upstream in versions 1.1.8, 1.2.9, and 2.0.1.  It has also been assigned the name CVE-2010-2057.

[1] https://issues.apache.org/jira/browse/MYFACES-2749

I believe the following is the commit that corrects this flaw, but will need to be verified:

http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801
Comment 1 Vincent Danen 2011-04-21 13:35:40 EDT
I'm looking at myfaces-1.1.0 which we have in JBEWS and I don't think we are affected by this.  The only support that StateUtils.java has is for base64-encoding, there are no other encryption-related functionality in this file.

Seems like all of the encryption-related functionality was implemented in the revision _after_ what we have:

http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=239625&r2=328309

So this should not affect us.  Can someone confirm?
Comment 2 Vincent Danen 2011-04-21 13:39:28 EDT
As a followup, there is another issue that was subsequently fixed:

https://issues.apache.org/jira/browse/MYFACES-2934 (Side-channel timing attack in StateUtils class may still allow padding oracle attack)
http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=951801&r2=1003345
Comment 4 David Jorm 2011-06-26 22:14:54 EDT
Statement:

Not vulnerable. This issue did not affect the versions of myfaces as shipped with JBoss Enterprise Web Server.

Note You need to log in before you can comment on or make changes to this bug.