CVE-2018-14667 PoC — RichFaces Framework 代码注入漏洞

Source

https://github.com/r00t4dm/CVE-2018-14667

Associated Vulnerability

Title: RichFaces Framework 代码注入漏洞 (CVE-2018-14667)
Description:The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Description

about CVE-2018-14667 from RichFaces Framework 3.3.4

Readme

# CVE-2018-14667 env


the rich.ser can open the Calculator.app only MacOs


download this project. the poc program in web-inf/src/Main.java

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →