Arbitrary EL Evaluation in RichFaces

Description
  • RichFaces is one of the most popular component libraries for JavaServer Faces (JSF). In early 2016, the developers of RichFaces announced the end-of-life of RichFaces in June 2016.

    The latest released versions of RichFaces (3.3.4 and 4.5.17) are affected by the following vulnerabilities:

    RF-14310: Arbitrary EL Evaluation in RichFaces 3.x <= 3.3.4
    Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource.

    RF-14309: Arbitrary EL Evaluation in RichFaces 4.5.3 <= 4.5.17
    Injection of arbitrary EL variable mapper allows to bypass mitigation of CVE-2015-0279 and thereby remote code execution.
Remediation
  • Mitigate these vulnerabilities by blocking requests to the affected URLs:
    Blocking requests of URLs with paths containing /DATA/ should mitigate CVE-2013-2165 and RF-14310.
    Blocking requests of URLs with paths containing org.richfaces.resource.MediaOutputResource (literally or URL encoded) should mitigate CVE-2015-0279 and RF-14309.
References