CVE-2017-1000486: Potential EL Injection

[n0def]

As already shared privately last year "/org/primefaces/application/resource/StreamedContentHandler.java" is to vulnerable to remote exploitable code execution through EL Injection

You can find more information here:
http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html

[cagataycivici]

Thank you, do you have any suggestion for a fix?

[cagataycivici]

Fixed via 26e44eb

Please review and reopen if necessary.

[n0def]

I'll check better tomorrow with our team, but the fix seems to be good

[cagataycivici]

Here is a refactor;

21b5b63

We keep a internal map at session now, this map holds the key-expression values. Keys are sent at at url and StreamedContentHandler gets the key to evaluate it. After it this map is cleared. Keys are encrypted uuids so there is still same encryption but expressions are not exposed at url directly now.

I'd appreciate your review.

[n0def]

This fix is a good fix, however since you are using UUID.randomUUID().toString() you don't need to encrypt the reference. You could pass the reference to the parameter as it is without encrypting it.

[cagataycivici]

Awesome, thank you for the feedback. We'll do patch releases now.

[kukel]

Great to see something like this fixed. Unfortunately only after public exposure... Bad publicity evidently works to get things done ;-)

Patch release of all 5.x community versions too? Otherwise exposure is still to big. Or just a small update jar?

[ng-anton]

does this vulnerability also affect primefaces 4.0? @cagataycivici

[tandraschko]

Probably, but not sure. You have to check the sources.

[ng-anton]

@tandraschko primefaces 4.0 has a different way of handling this kind of request. primefaces 4.0 has no StreamedContentHandler.java and DynamicResourceBuilder.java. But primefaces 4.0 has PrimeResourceHandler.java that is similar to StreamedContentHandler.java. Can I safely assume that primefaces 4.0 has no of this issue?

[tandraschko]

Nope sry, it has the same problem.

[ng-anton]

@tandraschko oh my... so is it sufficient if I just modify the PrimeResourceHandler.java just like StreamedContentHandler.java? What is the replacement of DynamicResourceBuilder.java in pf 4.0?

[tandraschko]

Don't have time to help you here. The DynamicResourceBuilder logic was was in each Renderer (GraphicImage, Media and another one). I would just upgrade, we fixed also some XSS and many other bugs in the last years.

[ng-anton]

@tandraschko i don't have time and resources to upgrade :) even though i want to upgrade. i think i will also look into each Renderer as you mentioned. thank you very much.

[bschuette]

I just got CVE-2017-1000486 assigned for this issue via iwantacve.org. This will soon be published on cve.mitre.org and cvedetails.com to help people filter out vulnerable versions.

[melloware]

It looks like Bitcoin Miners have found a way to exploit this bug so I highly recommend everyone upgrade to a newer patched version. https://forum.primefaces.org/viewtopic.php?f=3&t=53750

[kukel]

PF creating a 5.2-SR and 5.3-SR (Securit Release) would be a real, real good gesture...

See my comment almost 2 years ago: #1152 (comment)

[dataCore]

Temporary fix in apache config (/etc/apache2/sites-available/-ssl) by blocking (deny access) the exploit xhtml page:
<Location /javax.faces.resource/dynamiccontent.properties.xhtml>
Order allow,deny
Deny from all
</Location>

WARNING: if your page uses a functionality from 'dynamiccontent', it won't work anymore

[yanhdz]

I'm dealing with the same miner script

[cagataycivici]

@tandraschko blogged this https://www.primefaces.org/primefaces-el-injection-update/

[SebastianLindner]

I wrote an article how this vulnerability can be fixed for projects, when an update is not an option. The example is for PrimeFaces 4.
https://www.illucit.com/en/java-ee/primefaces-expression-language-remote-code-execution-fix/

[melloware]

Added CVE-2017-1000486 so future seekers can find this ticket.

[delisyd]

Hi there,
One quick question.
Do you know if Primefaces v5.1 is vulnerable? I have a customer who is running that version.
All the information that I see was about 5.2.x
@cagataycivici

[melloware]

Yes 5.1 is vulnerable I would move to 6.0 or higher immediately. Bitcoin miner malware was exploiting this defect.

[esternocleidomastoideo]

Please how do I get version 4.0.25?
I really need this version to fix a legacy system.

[jepsar]

@esternocleidomastoideo you'll need ELITE, see https://www.primefaces.org/showcase/support.xhtml

[esternocleidomastoideo]

Hello guys.
My customer purchased the elite plan but the 4.0.25 package is not available. Can anyone help?
I need fix for bug CVS-2017-1000486 for legacy system.

[melloware]

@esternocleidomastoideo i would send an email to mailto:contact@primetek.com.tr

[esternocleidomastoideo]

I don't understand how such an old update is not available for download until today.
I contacted support last week and all they told me was that it would be available this week.
Now I send emails asking for help and get ignored.
Someone please help me!
It is a case of extreme urgency.
I need the fix for the cvs-217-100486 bug and it needs to be version 4.0.25

[melloware]

@esternocleidomastoideo I understand your frustration. But shouldn't you be asking yourself why you want a patch to a 6 year old JAR for 1 security fix when there have been over 100 other security fixes in the years since.

https://github.com/primefaces/primefaces/issues?q=label%3A%22%3Alock%3A+security%22+is%3Aclosed

Shouldn't you be looking to upgrade your software and close "more holes" than focused on this 1 security issue in a 6 year old version? Just my two cents....

[tandraschko]

not talking about other libs and application servers... ;)

[esternocleidomastoideo]

Simple: it is no longer worth investing in this system and we have to comply with a company directive until it is replaced.
In addition there are thousands of other issues which I cannot mention here.

[melloware]

Understood. Just wanted to make sure you knew you were plugging one hole while the dam is still leaking all around you.

[esternocleidomastoideo]

the system has an expiration date but we really need to live up to the norm until it's gone forever.

[jepsar]

You can always overload the affected classes and patch them manually.