CVE-2010-4007

Vulnerability

Oracle Mojarra (the JSF reference implementation) encrypts the View State but does not include a Message Authentication Code (MAC) to verify integrity. This design flaw, related to CVE-2010-2057 affecting Apache MyFaces, makes the encrypted state susceptible to padding oracle attacks. The vulnerability affects all versions of Mojarra that use client-side state saving with encryption. [1][2]

Exploitation

An attacker with network access to a Mojarra-based application can send crafted requests containing modified encrypted View State values. By observing the server's responses (e.g., error messages or timing differences), the attacker can perform a padding oracle attack to decrypt and then re-encrypt the state with arbitrary modifications. No authentication is required beyond the ability to submit HTTP requests. [1][2]

Impact

Successful exploitation allows the attacker to modify the View State, potentially altering application behavior, bypassing authorization checks, or injecting malicious data. This can lead to information disclosure, privilege escalation, or other client-side manipulation. The attack does not require prior knowledge of the encryption key. [1][2]

Mitigation

Oracle has not released a specific fix for Mojarra; the recommended mitigation is to switch to server-side state saving, which transmits only an identifier and prevents modification of the component tree. For applications that must use client-side state saving, implement a custom MAC or upgrade to a version that includes integrity protection. As of the publication date, no official patch is available. [2]