I received an email from core Mojarra team member Jim Driscoll, who was inexplicably laid off from Sun after its recent acquisition by Oracle, about a talk at next week’s BlackHat Conference in Arlington, VA, U.S.A.. Jim pointed out that two security luminaries from the elite SpiderLabs team from Trustwave are giving a talk at BlackHat about view state security, specifically focusing on Mojarra and MyFaces.

Cursory research on the talk found two articles: one by Kelly Jackson Higgins at DarkReading, and another (which appears to be based on the first) at SC Magazine. The talk will be given by David Byrne (the guy who released grendel, not the guy from Talking Heads), and Rohini Sulatycki. For my money, the most important quote in the former article is, “There’s no patch to fix these flaws, either. ‘All developers have to do is perform a configuration change,’ he says, and encrypt view state.”

I haven’t seen their presentation yet, but for Mojarra, you can put lines 16 - 24 of the following web.xml into your web.xml to ensure that client state will be encrypted.

  1. <?xml version="1.0" encoding="UTF-8"?>
  3.     <servlet>
  4.         <servlet-name>Faces Servlet</servlet-name>
  5.         <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
  6.         <load-on-startup>1</load-on-startup>
  7.     </servlet>
  8.     <servlet-mapping>
  9.         <servlet-name>Faces Servlet</servlet-name>
  10.         <url-pattern>/faces/*</url-pattern>
  11.     </servlet-mapping>
  12.     <welcome-file-list>
  13.         <welcome-file>faces/index.xhtml</welcome-file>
  14.     </welcome-file-list>
  15.  
  16.     <context-param>
  17.         <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
  18.         <param-value>client</param-value>
  19.     </context-param>
  20.     <env-entry>
  21.         <env-entry-name>ClientStateSavingPassword</env-entry-name>
  22.         <env-entry-type>java.lang.String</env-entry-type>
  23.         <env-entry-value>driscoll</env-entry-value>
  24.     </env-entry>
  25. </web-app>
  26.  

A zipped netbeans project that does this is available at <http://mediacast.sun.com/users/edburns00/media/TestClientStatePassword.zip>

2 Comments

  • alexsmirnov Newbie

    alexsmirnov Feb 1, 2010 4:18 AM

    Yes, this is known problem, and that is why both JSF implementations have the view state encryption feature. Another hole has been introduced by JSF 2.0 AJAX feature there list of components to execute at form submission can be sent from client, so attacker has ability to change application logic ( bypass validation of some fields, for example ). There is no simple way to protect application from such vulnerability except additional checks in application code. That is why I've always been against "execute" or "update" parameters in AJAX request. //
    • mwessendorf Newbie

      mwessendorf Feb 1, 2010 11:24 PM