====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN107
_____________________________________________________________________

DATE                : 19/02/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running Apache MyFaces versions 2.2.0 up
                                       to 2.2.13,
                  2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, 3.0.0-RC1.

=====================================================================
http://mail-archives.apache.org/mod_mbox/www-announce/202102.mbox/%3cCALwS-OOFpNtkJ1N9SggQBP22NMwBNnxZchAdP3Zr=WQYExpLvQ@mail.gmail.com%3e
_____________________________________________________________________

CVE-2021-26296: Cross-Site Request Forgery (CSRF) vulnerability in
Apache MyFaces


Description:
In the default configuration, Apache MyFaces Core versions 2.2.0 to
2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use
cryptographically weak implicit and explicit cross-site request
forgery (CSRF) tokens. Due to that limitation, it is possible
(although difficult) for an attacker to calculate a future CSRF token
value and to use that value to trick a user into executing unwanted
actions on an application.

This issue is being tracked as MYFACES-4373

Mitigation:
Existing web.xml configuration parameters can be used to direct
MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom

Credit:
Apache MyFaces would like to thank Wolfgang Ettlinger (Certitude
Consulting GmbH)

Regards,
Bill Lucy, MyFaces PMC

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================