title: IBM AppScan - Java Deserialization Code Execution - JSF 2.2 & Primefaces - JBOSS 7.2 EAP
body: <p>Orginal Post <a href="https://stackoverflow.com/questions/61671067/ibm-appscan-on-a-jsf-2-2-primefaces-jboss-7-2-eap">IBM AppScan</a></p>
  
  <p>We recently received result from IBM AppScan DAST and some of the result don't make much senses.</p>
  
  <p>Java Deserialization Code Execution</p>
  
  <pre><code>Parameter: **javax.faces.ViewState**
  Risk(s): It is possible to run remote commands on the web server. This usually means complete compromise of the server and its
  contents
  
  The following changes were applied to the original request:
  Set the value of the parameter 'javax.faces.ViewState' to XXX
  
  
  
  POST /**/processitem.xhtml HTTP/1.1
  User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Win32)
  Connection: keep-alive
  Faces-Request: partial/ajax
  X-Requested-With: XMLHttpRequest
  Accept: application/xml, text/xml, */*; q=0.01
  Accept-Language: en-US,en;q=0.9
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  javax.faces.partial.ajax=true&amp;javax.faces.source=j_idt22%3Aj_idt23&amp;javax.faces.partial.execute=%40all&amp;javax.faces.partial.render=unreadCountForm&amp;j_idt22%3Aj_idt23=j_idt22%3Aj_idt23&amp;j_idt22=j_idt22
  &amp;
  </code></pre>
  
  <p><em>When i check the logs i seen Session Timeout (an error page)</em></p>
  
  <p>This would throw a ViewExpiredException and not sure why AppScan  believes it is a vulnerability.</p>
  
  <p>Looking for feedback and some insight.</p>