CVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Description
CVE-2018-14667 is a critical code injection vulnerability in the Red Hat JBoss RichFaces Framework version 3.X through 3.3.4 that allows remote, unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability exists in the UserResource resource handler, where an attacker can inject Expression Language (EL) expressions that are evaluated by the server, leading to full remote code execution via a chain of deserialized Java objects. With a CVSS score of 9.8 (Critical) and an EPSS score of 89.4% (99th percentile), CVE-2018-14667 represents an exceptionally high-risk vulnerability. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, underscoring the urgent need for organizations still running JBoss RichFaces to remediate immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | richfaces | >= 3.1.0, <= 3.3.4 |
| redhat | enterprise linux | 5.0; 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Mar/21(Mailing List, Third Party Advisory)
- http://www.securitytracker.com/id/1042037(Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2018:3517(Vendor Advisory)
- https://access.redhat.com/errata/RHSA-2018:3518(Vendor Advisory)
- https://access.redhat.com/errata/RHSA-2018:3519(Vendor Advisory)
- https://access.redhat.com/errata/RHSA-2018:3581(Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667(Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
Code injection vulnerabilities occur when an application incorporates user-controlled input into code that is subsequently executed by the application, allowing an attacker to inject and execute arbitrary code on the server. In CVE-2018-14667, the RichFaces Framework's UserResource component fails to properly sanitize user input before processing it as Expression Language expressions, enabling an attacker to inject malicious EL code that the server evaluates and executes.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2018-14667 is rated Critical with a CVSS 3.1 score of 9.8, the highest practical severity level, reflecting an extremely dangerous vulnerability. The attack vector is network-based, meaning it is remotely exploitable without physical access from anywhere on the internet. The attack complexity is low, requiring no special conditions, timing, or preparation to exploit. No authentication is needed and no user interaction is required, making this vulnerability trivially exploitable by any attacker who can reach the RichFaces application. Confidentiality (High): A successful exploit grants the attacker the ability to read any data accessible to the application server, including database credentials, configuration files, and business data. Integrity (High): The attacker can execute arbitrary code on the server, modify data, deploy backdoors, or alter application behavior. Availability (High): Full server compromise enables the attacker to disrupt services, destroy data, or render the application completely unavailable. The EPSS score of 89.4% (99th percentile) places this among the most likely-to-be-exploited vulnerabilities in existence, and public exploitation toolkits are available, making immediate remediation essential.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-14667 in the wild by adding it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 19, 2023. Public exploit code is available for CVE-2018-14667, including the Richsploit exploitation toolkit published on Packet Storm Security, which provides automated exploitation capabilities against vulnerable RichFaces installations. The EPSS score of 89.4% indicates near-certain exploitation activity, placing this vulnerability in the 99th percentile — meaning it is more likely to be exploited than 99.5% of all known vulnerabilities. While the ransomware association is currently listed as unknown, the availability of automated exploit toolkits and the trivially exploitable nature of the flaw make this a maximum-priority vulnerability.
Remediation
- Apply Red Hat security patches immediately as directed by the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Install the updates from Red Hat advisories RHSA-2018:3517, RHSA-2018:3518, RHSA-2018:3519, and RHSA-2018:3581.
- Upgrade or migrate away from RichFaces 3.X entirely, as the RichFaces Framework has reached end of life. Consider migrating to PrimeFaces, OmniFaces, or a modern front-end framework that is actively maintained and receives security updates.
- Block access to the vulnerable UserResource endpoint as an interim mitigation by configuring your web application firewall (WAF) or reverse proxy to deny requests to paths containing "/a4j/s/3_3_3.Final*" or similar UserResource URI patterns associated with RichFaces resource handling.
- Review server logs for indicators of compromise by searching for suspicious requests targeting the UserResource endpoint, unexpected Java deserialization activity, and any signs of webshells, reverse shells, or unauthorized processes spawned by the application server.
- Implement input validation and deserialization controls at the application layer by deploying a Java deserialization filter (such as JEP 290) to restrict which classes can be deserialized, reducing the risk of similar exploitation patterns in other components.
Technical Details
CVE-2018-14667 exploits a code injection flaw (CWE-94) in the RichFaces Framework 3.X UserResource component, specifically through the org.ajax4jsf.resource.UserResource$UriData class. The vulnerability allows an attacker to craft a specially formed request to the UserResource endpoint that contains malicious Expression Language (EL) expressions embedded in serialized Java objects. When the server processes this request, it deserializes the attacker-controlled data and evaluates the injected EL expressions, resulting in arbitrary code execution within the context of the application server. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that no authentication, user interaction, or special conditions are needed — the attacker simply sends a crafted HTTP request to achieve full remote code execution. The combination of EL injection and Java deserialization creates a particularly potent attack chain, as the deserialization step enables the attacker to instantiate arbitrary Java objects, while the EL injection provides a direct path to code execution on the server.
Frequently Asked Questions
Is CVE-2018-14667 being actively exploited?
Yes, CVE-2018-14667 is confirmed to be actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 19, 2023. Public exploitation toolkits such as Richsploit are freely available, making exploitation accessible even to less-skilled attackers. The EPSS score of 89.4% (99th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2018-14667?
CVE-2018-14667 affects the Red Hat JBoss RichFaces Framework versions 3.X through 3.3.4. Applications built on JBoss EAP (Enterprise Application Platform) that include the RichFaces component are vulnerable. Red Hat Enterprise Linux systems running affected JBoss deployments are also impacted.
How do I fix CVE-2018-14667?
Apply the security patches provided by Red Hat through advisories RHSA-2018:3517 through RHSA-2018:3581. However, since RichFaces has reached end of life, the recommended long-term fix is to migrate to an actively maintained JSF component library or modern front-end framework. As an interim measure, block access to the UserResource endpoint via WAF rules. See the Remediation section for detailed steps.
How severe is CVE-2018-14667?
CVE-2018-14667 is rated Critical with a CVSS 3.1 score of 9.8 out of 10, the highest practical severity. It allows unauthenticated remote code execution with no user interaction required. The EPSS score of 89.4% (99th percentile) means this vulnerability is more likely to be exploited than 99.5% of all known CVEs, making it one of the most dangerous vulnerabilities in any environment where RichFaces is still deployed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.