GHSA-j7mw-7crr-658v

Richfaces vulnerable to arbitrary code execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-14667

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.richfaces:richfaces-core	< 3.3.4	3.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-14667 advisory
https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06 web
https://access.redhat.com/errata/RHSA-2018:3517 web
https://access.redhat.com/errata/RHSA-2018:3518 web
https://access.redhat.com/errata/RHSA-2018:3519 web
https://access.redhat.com/errata/RHSA-2018:3581 web
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 web
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667 web
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html web
http://seclists.org/fulldisclosure/2020/Mar/21 web