EL Injection Vulnerability in Mojarra
Summary
DSA-2359-1: mojarra - EL injection. Affects mojarra versions < 2.0.3-1+squeeze1. Fixed in 2.0.3-1+squeeze1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mojarra is an implementation of JavaServer Faces (JSF), a Java specification for building web applications. It provides a framework for managing user interfaces and handling user input. Mojarra is widely used in Java web development and is included in various Java EE application servers. However, a vulnerability has been discovered in Mojarra that allows for Expression Language (EL) injection.
Vulnerability Detail
The vulnerability in Mojarra arises when the 'includeViewParameters' setting is enabled. In this case, untrusted values are evaluated as EL expressions, which can lead to arbitrary code execution. An attacker can exploit this vulnerability by injecting malicious EL expressions into user input fields or URLs. The consequences of successful exploitation include unauthorized access to sensitive data, remote code execution, and potential compromise of the entire application.
How To Fix
Minimum fixed version
2.0.3-1+squeeze1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mojarraTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Mojarra package is not immediately feasible, a temporary workaround is to disable the 'includeViewParameters' setting. This can be done by modifying the application's configuration files or code to set 'includeViewParameters' to false. However, this workaround may impact certain functionality that relies on view parameters.
Conclusion
The Mojarra package is vulnerable to an EL injection vulnerability that can lead to arbitrary code execution and compromise of the application. It is crucial to upgrade to the latest version of the package or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mojarra →
FAQ
Mojarra is an implementation of JavaServer Faces (JSF), a Java specification for building web applications. It provides a framework for managing user interfaces and handling user input.
EL injection is a vulnerability that occurs when untrusted data is evaluated as Expression Language (EL) expressions. This can lead to arbitrary code execution and potential compromise of the application.
The Mojarra vulnerability can be exploited by injecting malicious EL expressions into user input fields or URLs. This allows an attacker to execute arbitrary code and potentially gain unauthorized access to sensitive data.
Successful exploitation of the Mojarra vulnerability can result in unauthorized access to sensitive data, remote code execution, and potential compromise of the entire application.
To fix the Mojarra vulnerability, it is recommended to upgrade the Mojarra package to version 2.0.3-1+squeeze1 or later. This update includes a patch that prevents untrusted values from being evaluated as EL expressions.
Related vulnerabilities
Recent vulnerabilities recorded for mojarra.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.