cve/2021/CVE-2021-26296.md

### [CVE-2021-26296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26296)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20MyFaces%20Core&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Apache%20MyFaces%20Core%202.2%3C%202.2.14%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brighgreen)

### Description

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

### POC

#### Reference
- http://packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html
- http://seclists.org/fulldisclosure/2021/Feb/66

#### Github
- https://github.com/IBM/websphere-automation-lab
- https://github.com/arkarkala/ThinkLab-2257