Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-14667

CVE-2018-14667: Richfaces vulnerable to arbitrary code execution

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-14667
GHSA ID
GHSA-j7mw-7crr-658v
EPSS Score
0.99457%
CWE
CWE-94
Published
5/13/2022
Updated
7/20/2023
KEV Status
Yes
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.richfaces:richfaces-coremaven< 3.3.43.3.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers on EL injection during deserialization of UserResource$UriData objects. The primary vulnerable function is the readObject method where deserialization occurs without proper validation. The getELContext method is implicated as it would be involved in expression evaluation context setup. These functions would appear in stack traces when processing malicious serialized payloads through the UserResource endpoint.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** Ri******s *r*m*work *.X t*rou** *.*.* is vuln*r**l* to *xpr*ssion L*n*u*** (*L) inj**tion vi* t** Us*rR*sour** r*sour**. * r*mot*, un*ut**nti**t** *tt**k*r *oul* *xploit t*is to *x**ut* *r*itr*ry *o** usin* * ***in o* j*v* s*ri*liz** o*j**ts vi*

Reasoning

T** vuln*r**ility **nt*rs on *L inj**tion *urin* **s*ri*liz*tion o* `Us*rR*sour**$Uri**t*` o*j**ts. T** prim*ry vuln*r**l* *un*tion is t** `r***O*j**t` m*t*o* w**r* **s*ri*liz*tion o**urs wit*out prop*r v*li**tion. T** `**t*L*ont*xt` m*t*o* is impli*