Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized viewstate string.
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATHINFO to faces/javax.faces.resource/.
Quoting the upstream bug report [1]:
Both myfaces and mojarra only encrypt the state. What is missing is add a message authentication code (MAC) to the encryption to prevent padding oracle attack. The objective is detect if the received view state has been modified and do not process it, throwing ViewExpiredException.
The problem can be solved if users change to server side state saving, because on the view state only a identifier is sent and no changes on the component tree could be done with this configuration.
The proposed solution was add this new web-config params:
org.apache.myfaces.MACALGORITHM : Indicate the algorithm used to calculate the Message Authentication Code that is added to the view state.
org.apache.myfaces.MACSECRET : Define the initialization code that are used to initialize the secret key used on the Message Authentication Code algorithm.
org.apache.myfaces.MACSECRET.CACHE : If is set to "false", the secret key used for MAC algorithm is not cached. This is used when the returned SecretKey for mac algorithm is not thread safe.
It was unified security configuration in all branches to works the same. That means, it was included in 1.1.x the property org.apache.myfaces.USEENCRYPTION.
Now, if an error occur when the state is encrypted/decrypted, a ViewExpiredException is thrown, but the real exception is logged, to hide information that could be useful to non developers.
This was corrected upstream in versions 1.1.8, 1.2.9, and 2.0.1. It has also been assigned the name CVE-2010-2057.
[1] https://issues.apache.org/jira/browse/MYFACES-2749
I believe the following is the commit that corrects this flaw, but will need to be verified:
http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801
Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.