Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (CVE-2018-14667)

What is affected, what to do

This vulnerability allows for Remote Code Execution (RCE) through Expression Language (EL) Injection in JBoss RichFaces Framework versions 3.X to 3.3.4. An unauthenticated attacker can execute arbitrary code by exploiting the UserResource resource using a chain of Java serialized objects. The vulnerability is actively exploited in the wild, as evidenced by its inclusion in the CISA KEV list. All applications using the affected versions of the RichFaces Framework are at risk. An immediate update to the latest version is urgently required to mitigate this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• RichFaces eq affected 3.X through 3.3.4..affected 3.X through 3.3.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory all JBoss/JavaEE deployments for richfaces-core-impl-*.jar or richfaces-impl-*.jar version 3.x through 3.3.4 (find / -name "richfaces-*.jar" -exec unzip -p {} META-INF/MANIFEST.MF \; | grep -i version). RichFaces 3.x is end-of-life — NO vendor patch exists for the 3.x branch. JBoss EAP 4/5 bundling RichFaces 3.x is also out of support.
   • Launch a migration plan: upgrade to RichFaces 4.5.17.Final (last 4.x, itself EOL) or replace with PrimeFaces/OmniFaces. Until completed, treat the application as compromisable.
   • Shrink the attack surface immediately: block /*/UserResource/*, the full javax.faces.resource path and a4j/g/ at the reverse proxy (nginx, Apache, F5), especially requests carrying do= or base64/serialised parameters.
   • Emergency isolation of affected JBoss instances: review internet exposure and, where business-tolerable, restrict to internal/VPN access until decommissioning or migration completes.
   • Run a compromise assessment: review the last 180 days of access logs for UserResource requests with unusually large query strings and correlate with subsequent shell or webshell activity.
2. 02

   Runbook step 2

   Mitigation layers

   • Network perimeter: deploy a WAF rule that blocks URIs matching UserResource and request parameters containing serialised Java objects (magic bytes rO0AB in base64 or \xAC\xED\x00\x05 raw). Also filter EL-style payloads (${, #{, Runtime.getRuntime, ProcessBuilder).
   • Reverse-proxy allowlisting: expose only the JSF URL paths the application genuinely needs; drop /rfRes/, /a4j/, /faces/javax.faces.resource/ externally if not required.
   • JVM hardening: enable a Java SecurityManager with a restrictive java.policy that denies java.lang.Runtime.exec and java.lang.ProcessBuilder to the JBoss service user. The jboss account must never spawn shells.
   • Egress filtering: constrain outbound traffic from the JBoss host to known backends; block LDAP/RMI/HTTP(S) to untrusted destinations to neutralise RMI/LDAP deserialisation gadget chains.
   • Deserialisation hardening: where feasible set -Djdk.serialFilter to reject RichFaces/Ajax4jsf classes, in particular org.ajax4jsf.resource.UserResource$UriData.
   • OS hardening: mount /tmp, /var/tmp, /dev/shm with noexec (classic drop zones for second-stage payloads) and run AppArmor/SELinux profiles for the JBoss process in enforcing mode.
3. 03

   Runbook step 3

   Detection rules

   • Web-server access logs: hunt HTTP requests whose URI contains UserResource together with a do= parameter and a base64 blob longer than 200 characters. KQL shape: index=web uri_path="*UserResource*" | where len(uri_query) > 200 and uri_query like "%rO0AB%".
   • Sysmon/EDR: alert on process ancestry where java.exe/java spawns unexpected children (cmd.exe, powershell.exe, /bin/sh, bash, curl, wget, nc). Sigma shape: parent_image endswith '\java.exe' and image in ('cmd.exe','powershell.exe','bitsadmin.exe').
   • Linux auditd: execve events whose ppid is the JBoss process and exe matches {/bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/wget,/usr/bin/python*}. Rule: -a always,exit -F arch=b64 -S execve -F auid!=jboss -k jboss_child_exec.
   • Network telemetry (Zeek/Suricata): alert on outbound connections from the JBoss host to RMI/LDAP ports (1099, 1098, 389, 636, 8083) or HTTP requests with User-Agent Java/1.* to external IPs — hallmarks of marshalsec/ysoserial JNDI callbacks.
   • File-system monitoring: flag new .jsp/.jspx/.war files in deployment directories ($JBOSS_HOME/server/*/deploy, tmp/vfs-nested.tmp/) outside of change windows — classic webshell drops.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Red Hat Redhat Enterprise Linux
• Red Hat RichFaces

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

References & sources

• NVD (NIST)vuln/detail/CVE-2018-14667advisory
• github.comrichfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33faf…web
• access.redhat.comRHSA-2018:3517web, Vendor advisory, x_refsource_REDHAT, Vendor advisory
• access.redhat.comRHSA-2018:3518web, Vendor advisory, x_refsource_REDHAT, Vendor advisory
• access.redhat.comRHSA-2018:3519web, Vendor advisory, x_refsource_REDHAT, Vendor advisory
• access.redhat.comRHSA-2018:3581web, Vendor advisory, x_refsource_REDHAT, Vendor advisory
• bugzilla.redhat.comshow_bug.cgi?id=CVE-2018-14667web, x_refsource_CONFIRM, Issue tracking, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667web, government-resource, US government resource
• packetstormsecurity.comfiles/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlweb, x_refsource_MISC, Third-party advisory, Vulnerability database
• seclists.org20200313 RichFaces exploitation toolkitweb, Mailing list, x_refsource_FULLDISC, Mailing list, Third-party advisory
• securitytracker.com1042037Vulnerability database, x_refsource_SECTRACK, Third-party advisory, Vulnerability database