CVE-2017-1000486

PrimeFaces 5.x, a widely used JavaServer Faces (JSF) UI component library, ships with inadequate encryption strength (CWE-326) for the ViewState parameter, relying on a weak default key when applications do not configure their own secret. A remote, unauthenticated attacker can craft a malicious serialized Java object, encrypt it with the weak/default key, and submit it in the ViewState parameter of an exposed JSF application, which the server then decrypts and deserializes. Successful exploitation results in remote code execution with the privileges of the application server, giving full confidentiality, integrity, and availability impact (CVSS 9.8, network vector, no privileges or user interaction required). Any web application built on PrimeFaces 5.x and reachable over the network without authentication is affected. The flaw is being actively exploited: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-01-10, EPSS assigns a 94.1% 30-day exploitation probability (100th percentile), and a public proof-of-concept has been available since the 2016 Minded Security research on JSF/PrimeFaces deserialization RCE.

What to do: Upgrade PrimeFaces to a fixed, currently supported release per vendor instructions, as required by the CISA KEV action. Where an upgrade is not immediately possible, configure a unique, strong ViewState encryption secret for each application instead of the built-in default, and limit internet exposure of JSF endpoints (*.jsf, *.xhtml). Review web logs for POST requests carrying large ViewState parameters to 5.x-based applications as a sign of exploitation attempts.