Dissecting Java Server Faces for Penetration Testing - SecNiche ...

More documents

Recommendations

Info

Figure 5: Fuzzing Request / Error in Block SizeGenerally, if the ViewState is implemented on the server side, then it is agood security practice that the application should send a ViewState ID token asa hidden element in the HTML tag so that it can accompany legitimate requestsfrom the client side. If the application is only implementing ViewState on theserver side and is not using any ViewState ID, then it is possible that CSRF isnot handled appropriately. Tokens generated by using ”javax.faces.ViewState”(sequential) are easy to guess if not encrypted properly.Listing 2: Implementing ViewState Tracking on Server SideAs presented in listing 2, the j id2 parameter is set for the ViewState trackingon the server side. The attacker designs the next request in that session withViewState id as j id3, j id4 and so on which will be treated as legitimate by theserver. In Apache MyFaces ”org.apache.myfaces.NUMBER OF VIEWS IN SESSION”has a default value of 20 where as IBM Web sphere ”com.sun.faces.numberOfViewsInSession”has 15. These parameters specify the number of views that are stored in thesession when server side state saving is used.NOTE: In JSF, it is considered that ViewState can be used to prevent CSRF12
Figure 6: Fuzzing Request / Error in Last Blockattacks when collaboratively used with the JSESSIONID. As we have been discussing,ViewState implementation matters a lot. Now it has become possible tore encrypt the tampered ViewState and deliver it back to the server. EncryptingViewState and sending data over HTTPS are not the protection mechanismsagainst CSRF attacks. This has been widely misunderstood in the developercommunity.4.3.1 Implementing CSRF Protection - The Right WayStrong CSRF implementation in JSF can be implemented as• Applying Anti CSRF filters such as ”org.apache.catalina.filters.CsrfPreventionFilter”.The inbuilt class uses the ”java.util.Random” if explicitly specified by thedeveloper otherwise ”java.security.SecureRandom” will be used by default.One can also use OWASP CSRF Guard to integrate third party filters intoJSF.• If the ViewState session Id is to be used with every request then it mustbe strongly encrypted and an appropriate MAC should be applied in order13
Page 1 and 2: Dissecting Java Server Faces for Pe
Page 3 and 4: 1 AcknowledgmentsWe would like to t
Page 5 and 6: 3 Inside JSF FrameworkJava Server F
Page 8 and 9: understood. In ASP.Net, the ”View
Page 11: a large scale. A number of websites
Page 15 and 16: 4.4.1 Secure Way of Configuring Sec
Page 17 and 18: In this particular example, a regul
Page 19 and 20: As we can see, this approach allows
Page 21 and 22: 6 About the AuthorsAditya K Sood is
Page 23: [19] JSF Validation Tutorial, http:

Dissecting Java Server Faces for Penetration Testing - SecNiche ...

Create successful ePaper yourself

Delete template?

Save as template?