CVE-2017-1000486
Primetek Primefaces Remote Code Execution Vulnerability
Description
CVE-2017-1000486 is a critical remote code execution vulnerability in Primetek Primefaces 5.x, a popular JavaServer Faces (JSF) UI component library. The vulnerability stems from inadequate encryption strength used to protect a deserialization endpoint, allowing unauthenticated attackers to craft malicious payloads that bypass the weak encryption and execute arbitrary code on the server. With a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 93.04% (99.8th percentile), this Primefaces vulnerability is near-certain to be exploited. CISA has added CVE-2017-1000486 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| primetek | primefaces | >= 4.0, <= 4.0.24; >= 5.0, < 5.2.21; >= 5.3, < 5.3.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html(Exploit, Third Party Advisory)
- https://cryptosense.com/weak-encryption-flaw-in-primefaces/(Broken Link, Third Party Advisory)
- https://github.com/primefaces/primefaces/issues/1152(Issue Tracking, Third Party Advisory)
- https://www.exploit-db.com/exploits/43733/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000486(US Government Resource)
Weakness Type
CWE-326: Inadequate Encryption Strength
Inadequate Encryption Strength in Primetek Primefaces manifests through the use of a weak encryption scheme to protect the Expression Language (EL) evaluation endpoint. The encryption used to secure the javax.faces.resource parameter can be trivially broken, enabling attackers to decrypt, modify, and re-encrypt payloads that execute arbitrary EL expressions on the server. This weak cryptographic protection effectively provides no meaningful security barrier against exploitation.
Learn more: CWE-326 — Inadequate Encryption Strength
Impact Analysis
CVE-2017-1000486 carries a maximum-severity CVSS 3.1 score of 9.8 (CRITICAL), reflecting its devastating potential impact. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication or user interaction, making it trivial for attackers to exploit at scale. Confidentiality (High): attackers can read sensitive data from the server, including configuration files, database credentials, and application data. Integrity (High): arbitrary code execution allows attackers to modify data, deploy backdoors, and tamper with application logic. Availability (High): exploitation can lead to complete service disruption through denial-of-service or system takeover. The EPSS score of 93.04% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity in the wild.
Exploit Maturity
CVE-2017-1000486 has a mature exploit landscape with multiple public exploitation resources available. Public exploit code is available via Exploit Database and a detailed technical writeup is published on Minded Security describing the remote code execution technique. CISA has confirmed active exploitation by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-07-10. The EPSS score of 93.04% (99.8th percentile) indicates near-certain exploitation activity, consistent with the availability of weaponized exploit code and the trivial exploitation requirements.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Upgrade Primetek Primefaces to a patched version: update versions 4.x to a release beyond 4.0.24, versions 5.0.x-5.2.x to 5.2.21 or later, and versions 5.3.x to 5.3.8 or later.
- If immediate patching is not feasible, restrict network access to the Primefaces application using a web application firewall (WAF) to block requests targeting the
javax.faces.resourceendpoint with suspicious EL expression payloads. - Implement network segmentation to isolate the vulnerable application server from critical backend systems, limiting lateral movement in case of compromise.
- Review server logs for indicators of compromise, including unusual requests to Primefaces resource endpoints, unexpected process execution, and unauthorized file system modifications.
- As a long-term measure, audit all cryptographic implementations in the application stack to ensure they meet current standards (AES-256 for symmetric encryption, RSA-2048+ for asymmetric) and replace any deprecated or weak algorithms.
Technical Details
CVE-2017-1000486 exploits a weak encryption flaw in Primetek Primefaces 5.x where the EL expression evaluation endpoint uses an easily breakable encryption scheme to protect serialized data in the javax.faces.resource parameter. Attackers can reverse-engineer or brute-force the weak encryption key, decrypt the parameter value, inject malicious EL expressions, re-encrypt the payload, and send it to the server for execution. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires only network access with no authentication, special conditions, or user interaction. The underlying weakness, CWE-326 (Inadequate Encryption Strength), means the cryptographic protection is functionally equivalent to no protection at all, as the encryption can be broken with minimal computational resources. This results in unauthenticated remote code execution with the privileges of the application server process.
Frequently Asked Questions
Is CVE-2017-1000486 being actively exploited?
Yes. CVE-2017-1000486 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.04% (99.8th percentile) further indicates near-certain exploitation activity. Public exploit code is readily available, lowering the barrier for attackers.
What products are affected by CVE-2017-1000486?
CVE-2017-1000486 affects Primetek Primefaces versions 4.0 through 4.0.24, 5.0 through 5.2.20, and 5.3 through 5.3.7. Any Java web application using these Primefaces library versions is vulnerable to remote code execution.
How do I fix CVE-2017-1000486?
Upgrade Primefaces to a patched version: 5.2.21+ for the 5.2.x branch or 5.3.8+ for the 5.3.x branch. If immediate patching is not possible, use a WAF to block malicious requests targeting the EL expression evaluation endpoint and restrict network access to the application.
How severe is CVE-2017-1000486?
CVE-2017-1000486 has a CVSS 3.1 score of 9.8 (CRITICAL), the near-maximum severity rating. It allows unauthenticated remote code execution with no user interaction required. The 93.04% EPSS score places it in the 99.8th percentile of exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.