CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
Remote unauthenticated attackers can execute arbitrary code via Expression Language injection in the RichFaces framework.
- Exploited in the wild
- Since 28 Sep 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14667?
CVE-2018-14667 is a critical code injection vulnerability in Redhat Enterprise Linux, published on 6 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Weakness: CWE-94
Which versions are affected by CVE-2018-14667?
2 open source packages ship an affected version, including org.richfaces:richfaces-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.richfaces:richfaces-core Maven | All versions | 3.3.4 |
org.richfaces:richfaces-core Maven | All versions | 3.3.4 |
Linux distribution packages (12)
richfaces Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-cdk Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-demo Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-docs Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-framework Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-root Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces-ui Red Hat:jboss_enterprise_application_platform:5::el5 | All versions | 0:3.3.1-9.SP3_patch_03.ep5.el5 |
richfaces Red Hat:jboss_enterprise_application_platform:5::el6 | All versions | 0:3.3.1-6.SP3_patch_03.ep5.el6 |
richfaces-demo Red Hat:jboss_enterprise_application_platform:5::el6 | All versions | 0:3.3.1-6.SP3_patch_03.ep5.el6 |
richfaces-framework Red Hat:jboss_enterprise_application_platform:5::el6 | All versions | 0:3.3.1-6.SP3_patch_03.ep5.el6 |
richfaces-root Red Hat:jboss_enterprise_application_platform:5::el6 | All versions | 0:3.3.1-6.SP3_patch_03.ep5.el6 |
richfaces-ui Red Hat:jboss_enterprise_application_platform:5::el6 | All versions | 0:3.3.1-6.SP3_patch_03.ep5.el6 |
Products include Redhat Enterprise Linux, Redhat Richfaces.
How do I fix CVE-2018-14667?
Upgrade org.richfaces:richfaces-core to 3.3.4 or later. US federal agencies must fix it by 19 Oct 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-14667 being exploited?
Yes. Attackers have exploited CVE-2018-14667 in the wild since at least 28 Sep 2023.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
- CVE-2023-46846 Squid: request/response smuggling in http/1.1 and icap
Sources
Also known as GHSA-j7mw-7crr-658v, RHSA-2018:3517.