[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1137) Potentially large security hole in Seam Captcha implementation

[jbossseam-issues] [JBoss JIRA]...

Ian Hlavats (JIRA)

Monday, 2 April 2007 Mon, 2 Apr '07

2:36 a.m.

Potentially large security hole in Seam Captcha implementation -------------------------------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently. The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Show replies by date

Ian Hlavats (JIRA)

Monday, 2 April Mon, 2 Apr

2:36 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=all ] Ian Hlavats updated JBSEAM-1137: -------------------------------- Summary: Potential security issue in Seam captcha? (was: Potentially large security hole in Seam Captcha implementation)

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently. The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

-- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

Ian Hlavats (JIRA)

2:36 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=all ] Ian Hlavats updated JBSEAM-1137: -------------------------------- Description: I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks. was: I have been experiencing "holes" in the Seam captcha integration recently. The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Christian Bauer (JIRA)

2:41 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12358056 ] Christian Bauer commented on JBSEAM-1137: ----------------------------------------- What does this have to do with the captcha? If you save state on the client, you trust the client. Don't save state on the client if you can't trust the client.

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Ian Hlavats (JIRA)

3:05 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12358058 ] Ian Hlavats commented on JBSEAM-1137: ------------------------------------- Hi Christian, Perhaps this is just a documentation issue. I think it would benefit other Seam users to be informed about this potential problem. Can you update the Seam captcha documentation to include a note to the effect of, "server-side state saving is recommended for JSF applications using Seam's captcha support". Please note that I used the JCaptcha servlet on it's own in my JSF applications before I used the Seam captcha component (combined with JSF validation) and this issue never occurred. Thank you, Ian

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Ian Hlavats (JIRA)

3:12 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=all ] Ian Hlavats updated JBSEAM-1137: -------------------------------- Description: I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks. was: I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user can now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks. typo

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Gavin King (JIRA)

Thursday, 19 July Thu, 19 Jul

5:26 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Closed: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=all ] Gavin King closed JBSEAM-1137. ------------------------------ Resolution: Won't Fix

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Mariusz Smykula (JIRA)

Wednesday, 8 August Wed, 8 Aug

7:57 a.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12371471 ] Mariusz Smykula commented on JBSEAM-1137: ----------------------------------------- Why we need captcha, if we trust our clients? Captcha is needed when we dont trust them. Im wrong?

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Matt Drees (JIRA)

Saturday, 11 August Sat, 11 Aug

8:24 p.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12371801 ] Matt Drees commented on JBSEAM-1137: ------------------------------------ As I understand it, both MyFaces and the Sun RI allow you to encrypt the serialized component tree state.

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Ian Hlavats (JIRA)

8:36 p.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12371802 ] Ian Hlavats commented on JBSEAM-1137: ------------------------------------- Hi Matt, Encrypting the serialized component tree will not solve the problem of stale view state. The Sun JSF-RI team have implemented a fix for this issue. It will be available in 1.2_05. See the following link for more info: https://javaserverfaces.dev.java.net/issues/show_bug.cgi?id=612 Thanks, Ian

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

Matt Drees (JIRA)

Sunday, 12 August Sun, 12 Aug

2:28 p.m.

New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-1137) Potential security issue in Seam captcha?

[ http://jira.jboss.com/jira/browse/JBSEAM-1137?page=comments#action_12371809 ] Matt Drees commented on JBSEAM-1137: ------------------------------------ Ah, interesting. Thanks.

...

Potential security issue in Seam captcha? ----------------------------------------- Key: JBSEAM-1137 URL: http://jira.jboss.com/jira/browse/JBSEAM-1137 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.2.0.GA Environment: Any Reporter: Ian Hlavats I have been experiencing "holes" in the Seam captcha integration recently (eg. spam is getting through). The Seam documentation (section 21.1.1) recommends client-side state saving for JSF. The following scenario should point out a potential security issue with this approach. Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component. Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all. In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text. Can the malicious user now submit the previous copy of my form without the captcha component in the tree? I am using the MyFaces 1.1.4 JSF implementation. Thanks.

6345

days inactive

6477

days old

seam-issues@lists.jboss.org

Manage subscription

10 comments

5 participants

tags (0)

participants (5)

Christian Bauer (JIRA)
Gavin King (JIRA)
Ian Hlavats (JIRA)
Mariusz Smykula (JIRA)
Matt Drees (JIRA)

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1137) Potentially large security hole in Seam Captcha implementation