Bug 1639139 (CVE-2018-14667)

Summary: CVE-2018-14667 RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: aileenc, alazarot, anstephe, bmaxwell, cdewolf, chazlett, csutherl, darran.lofthouse, dimitris, dosoudil, etirelli, gmollett, grocha, gvarsami, ibek, jawilson, jcoleman, kconner, krathod, kverlaen, ldimaggi, lgao, loleary, lpetrovi, msochure, myarboro, nwallace, paradhya, pcheung, pgier, psakar, pslavice, rnetuka, rrajasek, rsvoboda, rsynek, rwagner, rzhang, sdaley, security-response-team, sfowler, spinder, tcunning, theute, tkirby, twalsh, vtunka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=critical,public=20181106:1844,reported=20181015,source=researcher,cvss3=9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,cwe=CWE-94,eap-5/RichFaces=affected,jbds-11/RichFaces=affected,jon-3/RichFaces=notaffected,brms-5/RichFaces=affected,soap-5/RichFaces=affected
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:39:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1639286, 1639942, 1639947, 1640775    
Bug Blocks: 1639140, 1639706, 1639707, 1639709, 1639711    

Description Sam Fowler 2018-10-15 06:48:54 UTC
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Comment 1 Sam Fowler 2018-10-15 07:22:57 UTC
Acknowledgments:

Name: Joao Filho Matos Figueiredo

Comment 9 errata-xmlrpc 2018-11-06 18:53:53 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2018:3518 https://access.redhat.com/errata/RHSA-2018:3518

Comment 10 errata-xmlrpc 2018-11-06 19:05:05 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 5 for RHEL 5
  Red Hat JBoss Enterprise Application Platform 5 for RHEL 6

Via RHSA-2018:3517 https://access.redhat.com/errata/RHSA-2018:3517

Comment 11 Chess Hazlett 2018-11-06 20:21:48 UTC
JON notaffected.

Comment 12 errata-xmlrpc 2018-11-07 01:49:18 UTC
This issue has been addressed in the following products:

  Red Hat JBoss SOA Platform

Via RHSA-2018:3519 https://access.redhat.com/errata/RHSA-2018:3519

Comment 13 errata-xmlrpc 2018-11-13 09:39:59 UTC
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2018:3581 https://access.redhat.com/errata/RHSA-2018:3581

Comment 14 Joshua Padman 2019-08-12 01:22:51 UTC
This vulnerability is out of security support scope for the following products:
 * JBoss Developer Studio 11

Please refer to https://access.redhat.com/node/4027141 for more details.