PT-2018-2617 · Red Hat · Jboss Richfaces

Published 2018-05-30 · Updated 2022-05-13 · CVE-2018-12533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions 3.1.0 through 3.3.4

Description The issue allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object. This is related to errors in code generation management. Exploitation of the issue may allow a remote attacker to execute arbitrary Java code with the privileges of the target service.

Recommendations For JBoss RichFaces versions 3.1.0 through 3.3.4, consider restricting access to the org.richfaces.renderkit.html.Paint2DResource$ImageData object to minimize the risk of exploitation. As a temporary workaround, avoid using paths with the /DATA/ substring until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

CWE-917

Related Identifiers

BDU:2019-01227

CVE-2018-12533

GHSA-4J38-WJHF-884R

RHSA-2018:2664

Affected Products

Jboss Richfaces

References · 13

• 🔥 https://github.com/llamaonsecurity/CVE-2018-12533 · Exploit
• 🔥 https://github.com/TheKalin/CVE-2018-12533 · Exploit
• https://access.redhat.com/errata/RHSA-2018:2663 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2664 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2930 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01227 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12533 · Security Note
• https://osv.dev/vulnerability/GHSA-4j38-wjhf-884r · Vendor Advisory
• http://securitytracker.com/id/1041617 · Note
• https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html · Note
• http://seclists.org/fulldisclosure/2020/Mar/21 · Note
• http://securityfocus.com/bid/104502 · Note