GHSA-FP43-VJ7G-PG92: GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library

#security #cve #cybersecurity #ghsa

GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library

Vulnerability ID: GHSA-FP43-VJ7G-PG92
CVSS Score: 7.5
Published: 2026-07-24

A multi-vector vulnerability advisory in the OmniFaces JavaServer Faces (JSF) utility library covers flaws leading to unauthenticated arbitrary file access, memory exhaustion (DoS), cross-site scripting (XSS), and WebSocket push channel hijacking.

TL;DR

OmniFaces versions prior to 2.7.33 contained flaws allowing arbitrary resource access, memory exhaustion, XSS via o:hashParam, and WebSocket hijacking, all mitigated in 2.7.33.

Technical Details

CWE ID: CWE-22, CWE-79, CWE-285, CWE-400, CWE-409
Attack Vector: Network
CVSS Score: 7.5 (High)
Exploit Status: Proof of Concept

Affected Systems

OmniFaces
OmniFaces: < 2.7.33 (Fixed in: 2.7.33)

Code Analysis

Commit: aa42da3

Restrict CombinedResourceInfo from serving non-combinable resources, enforce 64 KiB inflation limits, and prevent forged ID caching.

Commit: a52b924

Prevent empty source map caching in SourceMapResourceHandler to avoid memory exhaustion.

Commit: c43eef0

Escape JavaScript output in HashParam to mitigate XSS in AJAX update scripts.

Commit: d5cae24

Restrict session-scoped WebSocket channel access to authenticated session owners.

Mitigation Strategies

Upgrade the OmniFaces dependency to version 2.7.33 or later.
Deploy WAF rules to inspect and block anomalous Base64 payloads targeting the combined resource handler.
Ensure load balancers propagate the JSESSIONID cookie during WebSocket handshakes.

Remediation Steps:

Open the build configuration file (e.g., pom.xml) and locate the org.omnifaces:omnifaces dependency block.
Update the version attribute to 2.7.33.
Build and redeploy the application to the environment.
Monitor application logs for IllegalArgumentException related to unserialized data lengths.