Maven · org.omnifaces:omnifaces
OmniFaces: Forged combined-resource IDs and related output/push boundaries
CombinedResourceInfo accepts a path-derived ID without an authenticity check,
inflates it without an output limit, converts it to attacker-selected resource
identifiers, and retains unique IDs in an unbounded static cache. In bounded
tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1;
about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache
entries. A legitimately shaped short ID remained about 1:1, while malformed
input was rejected; the missing distinction is between a server-issued ID and
an attacker-minted but structurally valid ID.
The minimal application also confirmed three sink tails from the same forged-ID root:
.xhtml resource bypassed the excluded-resource boundary and
returned its raw content.omnifaces.graphic inner resource plus a canary Host header caused
an outbound GET to that host. This result is blind and deployment-dependent;
I am not claiming arbitrary-scheme or arbitrary-destination SSRF.These behaviors reproduce after the fix for CVE-2026-41883 / GHSA-vp6r-9m58-5xv8. That advisory concerned EL evaluation order in the wildcard CDN path. This report has a different root: unsigned combined IDs and missing decode/cache bounds, with separately demonstrated residual sink behavior.
With the documented optional source-map handler above a synthetic resource handler, 40 unique missing combined-resource requests grew the process-wide source-map cache from 13 to 92 entries. It has no size or eviction bound. This has a separate cache, configuration prerequisite, and fix from family 1.
A URL-fragment value containing a single-quote JavaScript payload was stored by
o:hashParam and later written unescaped into the Ajax callback script. On the
follow-up Ajax render, real Chrome executed the canary
window.__omniXss=1337. This requires a page using o:hashParam and the
follow-up Ajax render.
A fresh WebSocket client with no HTTP cookie connected using a victim's session-scoped channel ID and received the victim's subsequent push. The code checks application-wide ID existence but does not bind the handshake to the current HTTP session, despite the documented current-session guarantee. The UUID remains an unguessable bearer-token prerequisite; this is replay after token exposure, not brute force.
Twelve independent clients joined one application-scoped channel and all 12 received the same push. Current code sets every accepted session's maximum idle timeout to zero, retains sessions in an unbounded per-channel queue, and walks the full queue on each push. I am reporting the demonstrated mechanism as a bounded design weakness: container connection limits remain an outer bound, and I am not claiming unbounded heap growth from the 12-client test.
Servlets.facesRedirect XML issue is fixed on the current branch.
I am not reporting it as a new current-upstream issue.Host header.HashParam values must be escaped for a JavaScript string inside an XML
CDATA callback.Host value.HashParam callback
values.Daniel Birtwhistle
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.