Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | RichFaces | affected 3.X through 3.3.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 5 | richfaces +4 | 3.3.1-6.SP3_patch_03.ep5.el6 | RHSA-2018:3517 |
| Red Hat JBoss EAP 5 | richfaces-cdk +1 | 3.3.1-9.SP3_patch_03.ep5.el5 | RHSA-2018:3517 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 7 repositories
-
syriusbughunt/CVE-2018-14667 ★ 50 · Nov 30, 2018
All about CVE-2018-14667; From what it is to how to successfully exploit it.
-
Venscor/CVE-2018-14667-poc ★ 8 · Sep 23, 2019
CVE-2018-14667-poc Richfaces漏洞环境及PoC
-
zeroto01/CVE-2018-14667 ★ 2 · Nov 23, 2018
-
quandqn/cve-2018-14667 ★ 1 · Jul 29, 2019
-
r00t4dm/CVE-2018-14667 ★ 1 · Nov 28, 2018
about CVE-2018-14667 from RichFaces Framework 3.3.4
-
r4ch1d0/CVE-2018-14667_Lab_POC ★ 0 · Aug 31, 2026
Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server
-
nareshmail/cve-2018-14667 ★ 0 · Nov 18, 2018
cve-2018-14667 demo
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.richfaces:richfaces-core | < 3.3.4 | 3.3.4 | GHSA-j7mw-7crr-658v |
Advisories 2
- RHSA-2018:3517 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-2511 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Sep 28, 2023
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
- RHSA-2018:3519 vendor-advisory
- RHSA-2018:3581 vendor-advisory
- RHSA-2018:3518 vendor-advisory
- RHSA-2018:3517 vendor-advisory
- 1042037 vdb-entry
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
- 20200313 RichFaces exploitation toolkit mailing-list