CVE-2013-2165 Remote code execution due to insecure deserialization

High 7.5 Published 22 Jul 2013 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via crafted serialized data due to unrestricted deserialization in the RichFaces library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2165?

CVE-2013-2165 is a high-severity unsafe deserialization vulnerability in Redhat Jboss Enterprise Application Platform, published on 22 Jul 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Weakness: CWE-264

Which versions are affected by CVE-2013-2165?

4 open source packages ship an affected version, including org.richfaces:richfaces. It affects 8 products.

Package	Affected	Fixed in
`org.richfaces:richfaces` Maven	From `3.1.0`	`3.3.3`
`org.richfaces:richfaces` Maven	From `3.1.0`	`3.3.3`
`org.richfaces:richfaces` Maven	From `4.0.0`	`4.3.2`
`org.richfaces:richfaces` Maven	From `4.0.0`	`4.3.2`

Linux distribution packages (29)

`jboss-seam2` Red Hat:jboss_enterprise_application_platform:4.3.0::el4	All versions	`0:2.0.2.FP_SEC1-1.ep2.6.el4`
`jboss-seam2-docs` Red Hat:jboss_enterprise_application_platform:4.3.0::el4	All versions	`0:2.0.2.FP_SEC1-1.ep2.6.el4`
`jboss-seam2` Red Hat:jboss_enterprise_application_platform:4.3.0::el5	All versions	`0:2.0.2.FP_SEC1-1.ep2.6.el5`
`jboss-seam2-docs` Red Hat:jboss_enterprise_application_platform:4.3.0::el5	All versions	`0:2.0.2.FP_SEC1-1.ep2.6.el5`
`richfaces` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:3.3.1-11.SP3_patch_01.ep5.el4`
`richfaces-demo` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:3.3.1-11.SP3_patch_01.ep5.el4`
`richfaces-framework` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:3.3.1-11.SP3_patch_01.ep5.el4`
`richfaces-root` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:3.3.1-11.SP3_patch_01.ep5.el4`
`richfaces-ui` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:3.3.1-11.SP3_patch_01.ep5.el4`
`richfaces` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-demo` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-framework` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-root` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-ui` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-demo` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-framework` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-root` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-ui` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-demo` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-framework` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-root` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces-ui` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:3.3.1-6.SP3_patch_01.ep5.el5`
`richfaces` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-demo` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-framework` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-root` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`
`richfaces-ui` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:3.3.1-3.SP3_patch_01.ep5.el6`

Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Soa Platform, Redhat Jboss Enterprise Web Platform, Redhat Jboss Operations Network and 2 more.

How do I fix CVE-2013-2165?

Upgrade org.richfaces:richfaces to a fixed version for your release line: 3.3.3 or 4.3.2.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2013-2165 being exploited?

There is no known exploitation of CVE-2013-2165 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-4344-frcp-j22q, RHSA-2013:1042, RHSA-2013:1043, RHSA-2013:1044.