CVE-2018-14667

What is JBoss RichFaces?

RichFaces is (was) an open-source component library for JavaServer Faces (JSF), a Java web application framework, providing rich AJAX-enabled UI widgets. It was widely bundled into enterprise Java applications, including many built on Red Hat JBoss Enterprise Application Platform. RichFaces was end-of-life as of 2016, meaning applications still running it are, by definition, running unmaintained third-party code embedded inside otherwise-current Java web stacks.

Overview

CVE-2018-14667 is an expression language (EL) injection vulnerability in RichFaces reachable through its UserResource resource-serving component. A remote, unauthenticated attacker can send a crafted request containing a chain of Java serialized objects — specifically manipulating org.ajax4jsf.resource.UserResource$UriData — that, when deserialized and processed by the resource handler, results in evaluation of attacker-controlled EL expressions and ultimately arbitrary code execution on the server.

Technical Details

The root cause (CWE-94, Code Injection) is that the UserResource handler deserializes attacker-supplied data and uses portions of it to construct and evaluate EL expressions without adequate validation. Because UserResource is part of RichFaces' resource-loading machinery (used to serve CSS/JS/image resources for the UI components), it is exposed as an unauthenticated endpoint in any application including the vulnerable RichFaces version, giving a remote attacker code execution with a single crafted HTTP request and no credentials.

Discovery

The vulnerability was reported and tracked by Red Hat's security response team via Bugzilla; RichFaces itself was already end-of-life by the time this CVE was disclosed, so no further upstream fix was issued for the library — only guidance to remove or replace it.

Exploitation Context

CISA's KEV entry confirms this vulnerability has been exploited in the wild. Because RichFaces reached end-of-life years before this CVE's disclosure, applications still bundling it typically have no vendor patch path, making this a persistent, low-effort target for attackers scanning for legacy Java enterprise applications — a common pattern for JBoss/JSF deployments that were built years earlier and never had this now-abandoned dependency removed.

Remediation

1. Identify any application still bundling RichFaces (particularly RichFaces 3.x and 4.x) — check WAR/EAR dependency manifests, as it is frequently a transitive dependency inherited from older JSF-based projects.
2. Since RichFaces is end-of-life, plan to remove or replace the library entirely rather than expecting a further upstream patch; Red Hat's Bugzilla entry documents available guidance.
3. If immediate removal is not feasible, block or restrict access to UserResource-related request paths at the web server or WAF layer.
4. Isolate legacy JBoss/JSF applications that depend on RichFaces from the internet where business requirements allow.
5. Review application server logs for suspicious serialized-object payloads or EL injection patterns targeting UserResource.