Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qN213LTdjcnItNjU4ds37Kw

Richfaces vulnerable to arbitrary code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Permalink: https://github.com/advisories/GHSA-j7mw-7crr-658v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qN213LTdjcnItNjU4ds37Kw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.83783
EPSS Percentile: 0.98573

Identifiers: GHSA-j7mw-7crr-658v, CVE-2018-14667
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-14667
• https://access.redhat.com/errata/RHSA-2018:3517
• https://access.redhat.com/errata/RHSA-2018:3518
• https://access.redhat.com/errata/RHSA-2018:3519
• https://access.redhat.com/errata/RHSA-2018:3581
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
• http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
• http://seclists.org/fulldisclosure/2020/Mar/21
• https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06
• https://github.com/advisories/GHSA-j7mw-7crr-658v

Repository: https://github.com/richfaces/richfaces
Blast Radius: 14.0

Affected Packages