Open mzico opened 10 months ago
We need to fix it in 4.5.3
@yurem
one more on this RichFaces
Recommended Version : RichFaces 4.5.17
`RichFaces project had reached EOL in 2016, so no patch will be provided by vendor. It is recommended not to use RichFaces.
A vulnerable version of the RichFaces framework was identified. The RichFaces project is an advanced UI component framework for integrating AJAX capabilities into web applications using JSF. Various versions of RichFaces suffer from multiple remote code injection vulnerabilities as listed below. CVE-2018-12532: JBoss RichFaces via a MediaOutputResource's resource request, aka RF-14309 CVE-2018-12533: JBoss RichFaces via a /DATA/ substring in a path, aka RF-14310 CVE-2018-14667: JBoss RichFaces using UserResource$UriData CVE-2015-0279: JBoss RichFaces 'do' Parameter Remote Code Execution Vulnerability CVE-2013-2165: JBoss RichFaces CVE-2013-2165 Remote Code Execution Vulnerability RF-14309: Arbitrary EL Evaluation in RichFaces 4.5.3 through 4.5.17 RF-14310: Arbitrary EL Evaluation in RichFaces 3.x through 3.3.4
Affected Versions: All RichFaces 3.x, 4.x versions (including the latest vesions 3.3.4, 4.5.17) are vulnerable to remote code execution. List of security issues in various RichFaces versions: RichFaces 3: 3.1.0 through 3.3.3: CVE-2013-2165 3.1.0 through 3.3.4: RF-14310/CVE-2018-12533, CVE-2018-14667
RichFaces 4: 4.0.0 through 4.3.2: CVE-2013-2165 4.0.0 through 4.5.4: CVE-2015-0279 4.5.3 through 4.5.17: RF-14309/CVE-2018-12532
More information: https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
Note: This QID detects the use of RichFaces by checking for the presence of a client-side RichFaces JavaScript library. Impact Successful exploitation allows unauthenticated, remote attackers to execute arbitrary code within the context of the application. Solution RichFaces is end of life since 2016, so no patch will be provided by vendor. It is recommended not to use RichFaces.
Upgrade to RichFaces 3.3.4. Final or RichFaces 4.5.17 would remediate CVE-2013-2165 and CVE-2015-0279. There are no known fixes or patches available from vendor for RF-14309 or RF-14310**.
Ref: https://developer.jboss.org/docs/DOC-55384 Workaround: For suggestions on how to fix the issue, please refer https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html https://liferay.dev/blogs/-/blogs/mitigating-richfaces-4-5-17-final-eol-vulnerabilities`
@nynymike @mzico
@senthilkumardhanapal2 @yurem
In 4.5.3, we already using
jquery-ui-1.13.2.min.js and
RichFaces 4.5.19 (which is higher version than 4.5.17)
Tested in Gluu Server 4.5.2
Jquery Observation :
Vulnerable javascript library: jQuery.ui.dialog version: 1.12.1 script uri: https://host1.host.com/oxauth/js/jquery-ui.min.js
Details: CVE-2021-41182 : jQuery-UI versions before 1.13.0 are vulnerable to Cross-Site Scripting(XSS) attacks. Please refer to vendor documentation (https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/) for latest security updates.
CVE-2021-41183 : jQuery-UI versions before 1.13.0 are vulnerable to Cross-Site Scripting(XSS) attacks. Please refer to vendor documentation (https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/) for latest security updates.
CVE-2021-41184 : jQuery-UI versions before 1.13.0 are vulnerable to Cross-Site Scripting(XSS) attacks. Please refer to vendor documentation (https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/) for latest security updates.
CVE-2022-31160 : jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling ".checkboxradio( "refresh" )" on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the "label" in a "span".
Found on the following pages (only first 10 pages are reported): https://[hostname]/oxauth/error.htm
For Bootstrap
Recommended Version : jQuery UI 1.13.2