[TRINIDAD-2542] CVE-2016-5019: MyFaces Trinidad view state deserialization security vulnerability

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.2.14-core , 1.0.13-core , 2.0.1-core, 2.1.1-core
• Fix Version/s: 1.2.15-core , 2.0.2-core, 2.1.2-core
• Component/s: Components
• Assignee: Leonardo Uribe
• Reporter: Mike Kienenberger
• Created: 29/Sep/16 15:32
• Updated: 29/Sep/16 16:43
• Resolved: 29/Sep/16 16:00

Description

Trinidad’s CoreResponseStateManager both reads and writes view state strings using ObjectInputStream/ObjectOutputStream directly. By doing so, Trinidad bypasses the view state security features provided by the JSF implementations - ie. the view state is not encrypted and is not MAC’ed.

Trinidad’s CoreResponseStateManager will blindly deserialize untrusted view state strings, which makes Trinidad-based applications vulnerable to deserialization attacks.