<!--############################ Do not remove the line above ############################--> <!--Note that this issue is configured (see the quick actions at the bottom) to be created as confidential. Note that a vulnerability does not need to actually be resolved before it is reported and that these reports can be revised as needed (reopen the issue to request changes). If you do not know how to fill certain fields, mark that in the comment and we will help you.--> <!--Required. Specify the project's name (e.g., "Eclipse Dash") and Eclipse Foundation ID, e.g., "technology.dash".--> ## Basic information **Project name:** Eclipse Mojarra **Project id:** ee4j.mojarra ## What are the affected versions? Verified by source inspection of `org.glassfish:jakarta.faces`: | Line | Versions | |------|----------| | 4.0 | 4.0.0 – 4.0.28, current `4.0` branch | | 4.1 | 4.1.0 – 4.1.19, current `main` branch | | 5.0 | current `5.0` branch | | 3.0 | 3.0.5 (no longer maintained) | The vulnerable code has been in place since at least 2018 (Mojarra 2.3). Products that bundle Mojarra are likely affected as well. ## Details of the issue Preconditions: - The application enables URL client window mode, `jakarta.faces.CLIENT_WINDOW_MODE=url`. This is not the default. - A view renders an `<h:button>` with an `outcome`. In URL mode, `ClientWindowImpl.decode()` takes the client window id unvalidated from the `jfwid` request parameter. The `jakarta.faces.ClientWindow` parameter takes precedence when it is present, on GET as well as on POST. Mojarra then appends this id to generated URLs **without URL-encoding it**: - `com.sun.faces.context.ExternalContextImpl#encodeActionURL(String)` - `com.sun.faces.context.UrlBuilder#appendQueryString()`, used by `encodeBookmarkableURL`, `encodeRedirectURL` and `encodePartialActionURL` ```java builder.append(ResponseStateManager.CLIENT_WINDOW_URL_PARAM).append('=').append(clientWindowId); ``` `OutcomeTargetButtonRenderer#getOnclick()` renders the resulting URL into a JavaScript string literal: ```java onclick += "window.location.href='" + targetURI + "'; "; ``` - **Without a CSP nonce:** The handler is written via `ResponseWriter#writeAttribute("onclick", …)`. HTML attribute escaping does not help, because the browser decodes character references before it runs the handler. The attacker controls code that runs when the victim clicks the button. - **With `com.sun.faces.enableCspNonce=true`:** The handler is emitted via `RenderKitUtils#addEventListener` as `mojarra.ael('id','click',function(event){…})` inside a `<script nonce="…">` element. A payload that closes the function body runs **immediately on page load**. The CSP does not block it, because the script element carries the valid nonce. The same unencoded id also ends up in link hrefs, form actions and redirect `Location` headers. In those places it is not exploitable for script execution as far as I know, but it is still wrong. **Impact:** Reflected XSS in the origin of the application: session riding, reading data shown to the victim, phishing within the trusted origin. With CSP nonces enabled, the protection that applications rely on is bypassed. ## Steps to reproduce 1. Deploy a web application with: ```xml <context-param> <param-name>jakarta.faces.CLIENT_WINDOW_MODE</param-name> <param-value>url</param-value> </context-param> ``` and a page `button.xhtml`: ```xml <h:button id="button" outcome="target" value="target" /> ``` 2. Open: ``` /button.xhtml?jfwid=x%27%3Balert(document.domain)%3B%27 ``` 3. The button's handler is now: ``` window.location.href='/ctx/target.xhtml?jfwid=x';alert(document.domain);''; return false; ``` 4. Click the button: the alert appears. The same works with `jakarta.faces.ClientWindow=<payload>` instead of `jfwid`. The attached patch contains an Arquillian integration test (`test/clientWindowXss`) that reproduces the issue on GlassFish 7 with headless Chrome. Without the fix it fails with `injected script must not run ==> expected: <null> but was: <executed>`. **Variant with CSP nonce** (`com.sun.faces.enableCspNonce=true`): runs on page load, without a click. This variant is derived from the source and was not executed in a browser. ``` /button.xhtml?jfwid=x%27%7D)%3Balert(document.domain)%3B(function()%7B%27 ``` renders: ```html <script nonce="…">mojarra.ael('button','click',function(event){window.location.href='/ctx/target.xhtml?jfwid=x'});alert(document.domain);(function(){''; return false;})</script> ``` ## Do you know any mitigations of the issue? - **Do not use URL client window mode.** Keep `jakarta.faces.CLIENT_WINDOW_MODE` at its default `none`, if the application does not need it. - **Validate the id before Mojarra sees it.** Reject or strip requests whose `jfwid` or `jakarta.faces.ClientWindow` parameter does not match the expected format. Mojarra's own ids are `<UUID><separator><counter>`, so a character whitelist such as `[A-Za-z0-9_:.-]` works. - This can be done in a servlet filter or a reverse proxy/WAF rule. Both parameters, GET and POST, must be covered. - Alternatively, an application can wrap the `ClientWindowFactory`/`ClientWindow` and decode with a filtered request parameter map, so that Mojarra generates a fresh id for invalid input. - **Avoid `h:button` with `outcome`** on affected pages, for example in favour of `h:link`. The id would still be unencoded in the `href`, but it is not in a JavaScript context there. - **CSP:** Nonce-based CSP does **not** mitigate the issue (see above). ## Proposed fix URL-encode the client window id, and the names and values returned by `ClientWindow#getQueryURLParameters`, before they are appended to a URL. Use one shared helper for `ExternalContextImpl#encodeActionURL` and `UrlBuilder#appendQueryString`. A patch against the `4.0` branch is attached, with unit tests and the integration test mentioned above. It can be submitted as a pull request once the timing is agreed. Side effect: generated URLs change from `jfwid=<uuid>:0` to `jfwid=<uuid>%3A0`. The server decodes this transparently, and `faces.js` reads the id from the hidden field, not from the URL. [0001-Percent-encode-the-client-window-id-in-generated-URL.patch](/uploads/d9d12ea47c8fa0e81badd323d702e289/0001-Percent-encode-the-client-window-id-in-generated-URL.patch)