WaratekVRT Sign in

CVE-2018-14667 RichFaces

Affected softwareRichFaces
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in3.3.4
WeaknessCode injection (CWE-94)
Published6 Nov 2018
Updated29 Sep 2026

Description

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-09-28 · remediation due 2023-10-19 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · 3 exploits · earliest 2023-09-28.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 7 indexed Published artifacts you can open, in GitHub PoC; first seen 2018-11-18.
  • EPSS 71% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-14667 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2023-09-28
Exploit reference VulnCheck XDB 19e2dcdd6dd0 Exploit type: client-side 2018-11-30
Exploit reference VulnCheck XDB 484aa7ad502f Exploit type: initial-access 2023-12-21
Exploit reference VulnCheck XDB b50df08cf3e6 Exploit type: initial-access 2026-08-31

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC All about CVE-2018-14667; From what it is to how to successfully exploit it. 50 2018-11-30
GitHub PoC CVE-2018-14667-poc Richfaces漏洞环境及PoC 8 2019-09-23
GitHub PoC zeroto01/CVE-2018-14667 2 2018-11-23
GitHub PoC quandqn/cve-2018-14667 1 2019-07-29
GitHub PoC about CVE-2018-14667 from RichFaces Framework 3.3.4 1 2018-11-28
GitHub PoC Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server 2026-08-31
GitHub PoC cve-2018-14667 demo 2018-11-18

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

RichFaces EL injection via a serialized UserResource$UriData in the resource URL. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec/ProcessBuilder.start the expression makes. An expression that reads or changes files or data directly in Java, without starting a program, is not stopped.

How to mitigate CVE-2018-14667

Upgrade RichFaces to 3.3.4 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert@redhat.com Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.richfaces:richfaces-core 0 3.3.4 unbounded

Products and versions

3 products, 4 version entries
SourceVendorProductSchemeAffected versions
osv org.richfaces richfaces-core generic ＜ 3.3.4
nvd redhat enterprise linux generic 5.0 · 6.0
nvd redhat richfaces generic ≥ 3.1.0 and ≤ 3.3.4

References

URLTags
https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06 WEB
https://access.redhat.com/errata/RHSA-2018:3517 WEB
https://access.redhat.com/errata/RHSA-2018:3518 WEB
https://access.redhat.com/errata/RHSA-2018:3519 WEB
https://access.redhat.com/errata/RHSA-2018:3581 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667 WEB
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html WEB
http://seclists.org/fulldisclosure/2020/Mar/21 WEB
http://www.securitytracker.com/id/1042037 Third Party Advisory, VDB Entry

Timeline
Published2018-11-06By the CVE Program.
Added to CISA KEV2023-09-28Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2023-09-28Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-08-31Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.