CVE-2017-17837

Vulnerability

Apache DeltaSpike-JSF 1.8.0 module suffers from a cross-site scripting (XSS) injection vulnerability in the windowId handling within WindowIdHtmlRenderer.java. The windowId parameter is written directly into a JavaScript context without sanitization, allowing injection of arbitrary HTML or script code. The default maxWindowIdLength truncates the value to 10 characters, which limits the potential for crafted payloads but does not eliminate the risk. The issue is specific to version 1.8.0 [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a crafted windowId value, for example via a URL parameter or other untrusted input, that is processed by the JSF component. The value is inserted into a JavaScript block rendered by encodeBegin(). No special network position or authentication is required beyond the ability to inject a value into the windowId field. If the injected string contains JavaScript code within the 10-character limit (or if the limit is overridden), XSS could be triggered when the page is rendered [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to disclosure of sensitive information, session hijacking, or defacement of the application UI. The impact is limited by the default character truncation, but in environments where the maxWindowIdLength is increased or the payload fits within 10 characters, the attack is fully effective [1][2].

Mitigation

The vulnerability is fixed in Apache DeltaSpike 1.8.1, released in January 2018. The fix changes the encodeBegin() method to use writeText() instead of direct string concatenation, which properly escapes the windowId value [3][4]. Users should upgrade to DeltaSpike 1.8.1 or later. No workaround is provided for version 1.8.0.