PT-2021-16989 · Apache · Apache Myfaces Core

Wolfgang Ettlinger · Published 2021-02-19 · Updated 2021-06-16 · CVE-2021-26296

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions 2.2.0 through 2.2.13 Apache MyFaces Core versions 2.3.0 through 2.3.7 Apache MyFaces Core versions 2.3-next-M1 through 2.3-next-M4 Apache MyFaces Core version 3.0.0-RC1

Description The issue arises from the use of cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens in the default configuration. This weakness makes it possible, although difficult, for an attacker to calculate a future CSRF token value and use it to trick a user into executing unwanted actions on an application.

Recommendations For Apache MyFaces Core versions 2.2.0 through 2.2.13, update the web.xml configuration parameters to use SecureRandom for CSRF token generation by setting org.apache.myfaces.RANDOM KEY IN VIEW STATE SESSION TOKEN, org.apache.myfaces.RANDOM KEY IN CSRF SESSION TOKEN, and org.apache.myfaces.RANDOM KEY IN WEBSOCKET SESSION TOKEN to secureRandom. For Apache MyFaces Core versions 2.3.0 through 2.3.7, update the web.xml configuration parameters to use SecureRandom for CSRF token generation by setting org.apache.myfaces.RANDOM KEY IN VIEW STATE SESSION TOKEN, org.apache.myfaces.RANDOM KEY IN CSRF SESSION TOKEN, and org.apache.myfaces.RANDOM KEY IN WEBSOCKET SESSION TOKEN to secureRandom. For Apache MyFaces Core versions 2.3-next-M1 through 2.3-next-M4, update the web.xml configuration parameters to use SecureRandom for CSRF token generation by setting org.apache.myfaces.RANDOM KEY IN VIEW STATE SESSION TOKEN, org.apache.myfaces.RANDOM KEY IN CSRF SESSION TOKEN, and org.apache.myfaces.RANDOM KEY IN WEBSOCKET SESSION TOKEN to secureRandom. For Apache MyFaces Core version 3.0.0-RC1, update the web.xml configuration parameters to use SecureRandom for CSRF token generation by setting org.apache.myfaces.RANDOM KEY IN VIEW STATE SESSION TOKEN, org.apache.myfaces.RANDOM KEY IN CSRF SESSION TOKEN, and org.apache.myfaces.RANDOM KEY IN WEBSOCKET SESSION TOKEN to secureRandom.

Exploit

Fix

Use of Insufficiently Random Values

CSRF

Weakness Enumeration

CWE-330

CWE-352

Related Identifiers

CVE-2021-26296

GHSA-GQ67-PP9W-43GP

Affected Products

Apache Myfaces Core

References · 14

• 🔥 http://packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html · Exploit
• https://lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26296 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26296 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq67-pp9w-43gp · Vendor Advisory
• https://github.com/apache/myfaces/commit/cc6e1cc7b9aa17e52452f7f2657b3af9c421b2b2 · Note
• https://t.me/cybersecuritytechnologies/2746 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210528-0007 · Note
• http://seclists.org/fulldisclosure/2021/Feb/66 · Note
• https://t.me/cvenotify/10143 · Telegram Post
• https://t.me/cvenotify/15169 · Telegram Post
• https://issues.apache.org/jira/browse/MYFACES-4373 · Note
• https://t.me/cibsecurity/23846 · Telegram Post
• https://t.me/cvenotify/10566 · Telegram Post