Description
RichFaces is one of the most popular component libraries for JavaServer Faces (JSF). In early 2016, the developers of RichFaces announced the end-of-life of RichFaces in June 2016.
The latest released versions of RichFaces (3.3.4 and 4.5.17) are affected by the following vulnerabilities:
RF-14310: Arbitrary EL Evaluation in RichFaces 3.x <= 3.3.4
Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource.
RF-14309: Arbitrary EL Evaluation in RichFaces 4.5.3 <= 4.5.17
Injection of arbitrary EL variable mapper allows to bypass mitigation of CVE-2015-0279 and thereby remote code execution.
Remediation
Mitigate these vulnerabilities by blocking requests to the affected URLs:
Blocking requests of URLs with paths containing /DATA/ should mitigate CVE-2013-2165 and RF-14310.
Blocking requests of URLs with paths containing org.richfaces.resource.MediaOutputResource (literally or URL encoded) should mitigate CVE-2015-0279 and RF-14309.
References
Related Vulnerabilities
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0245)
Joomla CVE-2012-0821 Vulnerability (CVE-2012-0821)
MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-34750)
TYPO3 Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-2717)