Description
RichFaces is one of the most popular component libraries for JavaServer Faces (JSF). In early 2016, the developers of RichFaces announced the end-of-life of RichFaces in June 2016.
The latest released versions of RichFaces (3.3.4 and 4.5.17) are affected by the following vulnerabilities:
RF-14310: Arbitrary EL Evaluation in RichFaces 3.x <= 3.3.4
Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource.
RF-14309: Arbitrary EL Evaluation in RichFaces 4.5.3 <= 4.5.17
Injection of arbitrary EL variable mapper allows to bypass mitigation of CVE-2015-0279 and thereby remote code execution.
Remediation
Mitigate these vulnerabilities by blocking requests to the affected URLs:
Blocking requests of URLs with paths containing /DATA/ should mitigate CVE-2013-2165 and RF-14310.
Blocking requests of URLs with paths containing org.richfaces.resource.MediaOutputResource (literally or URL encoded) should mitigate CVE-2015-0279 and RF-14309.
References
Related Vulnerabilities
WordPress Other Vulnerability (CVE-2006-2667)
Jetty Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-8184)
MySQL CVE-2022-21286 Vulnerability (CVE-2022-21286)
Joomla Improper Input Validation Vulnerability (CVE-2021-26036)
ASP.NET MVC Improper Input Validation Vulnerability (CVE-2017-0249)