CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote,...

Basic Information

CVE State: PUBLISHED
Reserved Date: July 27, 2018
Published Date: November 06, 2018
Last Updated: February 07, 2025
Vendor: [UNKNOWN]
Product: RichFaces
Description: The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

CVSS Scores

CVSS v3.0

9.8 - CRITICAL

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2023-09-28 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2018-11-28 07:35:28 UTC) Source

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 https://access.redhat.com/errata/RHSA-2018:3519 https://access.redhat.com/errata/RHSA-2018:3581 https://access.redhat.com/errata/RHSA-2018:3518 https://access.redhat.com/errata/RHSA-2018:3517 http://www.securitytracker.com/id/1042037 http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html http://seclists.org/fulldisclosure/2020/Mar/21

Known Exploited Vulnerability Information

Source	Added Date
CISA	2023-09-28 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

Venscor/CVE-2018-14667-poc

Type: github • Created: 2019-09-23 07:45:01 UTC • Stars: 8

CVE-2018-14667-poc Richfaces漏洞环境及PoC

syriusbughunt/CVE-2018-14667

Type: github • Created: 2018-11-30 04:06:08 UTC • Stars: 50

All about CVE-2018-14667; From what it is to how to successfully exploit it.

r00t4dm/CVE-2018-14667

Type: github • Created: 2018-11-28 07:35:28 UTC • Stars: 1

about CVE-2018-14667 from RichFaces Framework 3.3.4

zeroto01/CVE-2018-14667

Type: github • Created: 2018-11-23 06:44:49 UTC • Stars: 2