Renaud Dubourguais and Nicolas Collignon released a nice paper on Java Server Faces security titled JSF ViewState upside-down (http://www.synacktiv.fr/ressources/JSF_ViewState_InYourFace.pdf).
JSF implementations are often used in J2EE applications. JSF uses ViewStates which have already been discussed for cryptographic weaknesses like with the oracle padding attack [PADDING]. ViewStates have also been abused to create client side attacks like Cross-Site Scripting [XSS]. But as shown in this research, they can also be used to perform much more dangerous attacks on web applications:
- Business data leak
- Direct object references exploitation
- Bypassing user inputs validators
- Arbitrary code execution