CVE-2018-14667 PoC — RichFaces Framework 代码注入漏洞

Source

https://github.com/nareshmail/cve-2018-14667

Associated Vulnerability

Title: RichFaces Framework 代码注入漏洞 (CVE-2018-14667)
Description:The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Description

cve-2018-14667 demo

Readme

# cve-2018-14667

#cve-2018-14667 demo

![image](https://github.com/greekn/cve-2018-14667/blob/master/cve-2018-14667.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →