primefaces - IBM AppScan - Java 反序列化代码执行 - JSF 2.2 和 Primefaces - JBOSS 7.2 EAP

Question

原始帖子IBM AppScan

我们最近收到了来自 IBM AppScan DAST 的结果，其中一些结果没有多大意义。

Java反序列化代码执行

Parameter: **javax.faces.ViewState**
Risk(s): It is possible to run remote commands on the web server. This usually means complete compromise of the server and its
contents

The following changes were applied to the original request:
Set the value of the parameter 'javax.faces.ViewState' to XXX



POST /**/processitem.xhtml HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Win32)
Connection: keep-alive
Faces-Request: partial/ajax
X-Requested-With: XMLHttpRequest
Accept: application/xml, text/xml, */*; q=0.01
Accept-Language: en-US,en;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
javax.faces.partial.ajax=true&javax.faces.source=j_idt22%3Aj_idt23&javax.faces.partial.execute=%40all&javax.faces.partial.render=unreadCountForm&j_idt22%3Aj_idt23=j_idt22%3Aj_idt23&j_idt22=j_idt22
&

当我检查日志时，我看到了会话超时（错误页面）

这将引发 ViewExpiredException 并且不确定 AppScan 为何认为它是一个漏洞。

寻找反馈和一些见解。

标签： primefacesjsf-2.2