Deserialization of untrusted data in JBoss Richfaces - CVE-2018-14667
Published: November 6, 2018 / Updated: September 28, 2023
Vulnerability identifier: #VU15750
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14667
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to deserialization of untrusted data. A remote unauthenticated attacker can send a specially crafted UserResource RichFaces expression language that contains a tainted java serialized object org.ajax4jsf.resource.UserResource$UriData expression, trigger deserialization after clearing white list protections and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
JBoss Richfaces
How to mitigate CVE-2018-14667
Install update from vendor's website.