CVE-2018-14667 PoC — RichFaces Framework 代码注入漏洞

Source

https://github.com/quandqn/cve-2018-14667

Associated Vulnerability

Title: RichFaces Framework 代码注入漏洞 (CVE-2018-14667)
Description:The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Readme

# cve-2018-14667

POC for CVE-2018-14667

Original analysis and POC: https://paper.seebug.org/765/

Ref: https://web.archive.org/web/20190501081357/https://tint0.com/when-el-injection-meets-java-deserialization/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →