CVE-2018-14667

Executive Summary

CVE-2018-14667 affects the RichFaces Framework versions 3.X through 3.3.4. The vulnerability is an Expression Language (EL) injection flaw in the UserResource resource that permits remote, unauthenticated attackers to execute arbitrary code. Exploitation occurs through a chain of Java serialized objects using the class org.ajax4jsf.resource.UserResource$UriData. The CVSS score is 9.8, indicating critical severity with potential for full system compromise. Enterprise deployments relying on this framework remain exposed due to the absence of any tracked patches.

Technical Analysis

The RichFaces Framework 3.X through 3.3.4 processes requests through the UserResource resource, which handles URI data via the class org.ajax4jsf.resource.UserResource$UriData. This class accepts serialized Java objects that are deserialized without sufficient validation. The deserialization path leads directly to EL evaluation, allowing an attacker to inject expressions that resolve to arbitrary code execution. The attack surface is the unauthenticated HTTP endpoint serving UserResource, which accepts crafted serialized payloads. No additional authentication or session state is required. The mechanism relies on the framework's handling of resource URIs that trigger object deserialization followed by EL resolution, resulting in remote code execution on the Java application server.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.
Steps: 1) Reconnaissance/target identification involves locating exposed RichFaces 3.X deployments that serve the UserResource endpoint. 2) The specific flaw class is triggered by sending a crafted request containing a serialized object chain to the UserResource resource. 3) Payload/execution method at the vulnerability-class level uses Java serialized objects via org.ajax4jsf.resource.UserResource$UriData to reach EL injection and execute arbitrary code. 4) Post-exploitation impact includes full remote code execution on the underlying Java virtual machine, enabling shell access or further lateral movement within the application server.

Impact Assessment

The vulnerability allows complete compromise of affected Java applications with a CVSS score of 9.8. Affected systems include any enterprise web application using RichFaces 3.X through 3.3.4 that exposes the UserResource endpoint to the internet or untrusted networks. Blast radius extends to the full application server process, potentially impacting connected databases, internal services, and downstream systems. High impact on confidentiality, integrity, and availability is realized through arbitrary code execution without requiring user interaction.

Detection Guidance

Sigma Rule

title: RichFaces EL Injection via UserResource
id: 8f4c2a1b-3e9d-4f2a-9c7b-1a2b3c4d5e6f
status: experimental
description: Detects serialized object chains targeting org.ajax4jsf.resource.UserResource$UriData
logsource:
  category: webserver
  product: apache
detection:
  selection:
    request_uri|contains: "/rfRes/"
    request_method: POST
  condition: selection
fields:
  - client_ip
  - request_uri
level: high

YARA Rule

rule RichFaces_EL_Injection_Serialized {
    meta:
        description = "Detects patterns associated with CVE-2018-14667 serialized payloads"
        author = "valtersit.com"
    strings:
        $s1 = "org.ajax4jsf.resource.UserResource$UriData"
        $s2 = "java serialized"
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"RichFaces UserResource EL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/rfRes/"; classtype:web-application-attack; sid:1000001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where url.path like "*UserResource*" and http.request.method == "POST"]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*UserResource*" method=POST | stats count by src_ip uri_path

Wazuh OSSEC Rule

<rule id="100001" level="12">
  <if_sid>31100</if_sid>
  <match>POST.*UserResource</match>
  <description>RichFaces EL injection via serialized UserResource$UriData</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations include network segmentation to restrict access to RichFaces endpoints and web application firewall rules blocking POST requests containing serialized Java object signatures to UserResource paths. 2) Patch/upgrade steps are unavailable; no vendor fix or updated version has been identified. 3) Long-term hardening requires migrating away from RichFaces 3.X entirely and implementing input validation plus safe deserialization practices on any remaining Java frameworks.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-14667
https://access.redhat.com/security/cve/CVE-2018-14667
No known threat actor campaigns or exploit-in-the-wild evidence recorded in CISA KEV.