CRITICAL9.8

GHSA-j7mw-7crr-658v

Richfaces vulnerable to arbitrary code execution

Quick fix

GHSA-j7mw-7crr-658v — org.richfaces:richfaces-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.3.4</version> for org.richfaces:richfaces-core

Details

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.richfaces:richfaces-core

Introduced in: 0Fixed in: 3.3.4

Fix# pom.xml: bump <version>3.3.4</version> for org.richfaces:richfaces-core

References

https://nvd.nist.gov/vuln/detail/CVE-2018-14667[ADVISORY]
https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06[WEB]
https://access.redhat.com/errata/RHSA-2018:3517[WEB]
https://access.redhat.com/errata/RHSA-2018:3518[WEB]
https://access.redhat.com/errata/RHSA-2018:3519[WEB]
https://access.redhat.com/errata/RHSA-2018:3581[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667[WEB]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667[WEB]
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html[WEB]
http://seclists.org/fulldisclosure/2020/Mar/21[WEB]