CVE-2018-14667
CRITICAL KEVRichFaces Framework 3.X-3.3.4 - Code Injection
Title source: llmExploitation Summary
CVE-2018-14667 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 28, 2023. EIP tracks 6 public exploits from researchers including syriusbughunt, Venscor, zeroto01.
AI-analyzed exploit summary This repository contains a working proof-of-concept exploit for CVE-2018-14667, a remote code execution vulnerability in RichFaces 3.X. The exploit leverages deserialization of malicious objects to execute arbitrary commands on the target system.
Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Exploits (6)
This repository contains a working proof-of-concept exploit for CVE-2018-14667, a remote code execution vulnerability in RichFaces 3.X. The exploit leverages deserialization of malicious objects to execute arbitrary commands on the target system.
This repository contains a working PoC for CVE-2018-14667, a deserialization vulnerability in RichFaces. The exploit generates a malicious serialized object that, when deserialized, executes arbitrary EL expressions leading to remote code execution.
This repository contains a proof-of-concept exploit for CVE-2018-14667, a vulnerability in the Windows operating system that allows for remote code execution. The exploit is provided as a JavaScript file that, when executed, launches the Windows calculator application as a demonstration of the vulnerability.
This PoC exploits CVE-2018-14667, a deserialization vulnerability in JBoss RichFaces, by crafting a malicious serialized object that executes arbitrary EL expressions. The payload leverages JavaScript engine execution to achieve remote code execution (RCE).
This repository contains a proof-of-concept exploit for CVE-2018-14667, a deserialization vulnerability in RichFaces. The exploit generates a malicious serialized object that, when deserialized, executes arbitrary commands via EL expressions.
This repository contains a README file with a brief description and a GIF demonstrating CVE-2018-14667, a vulnerability in the V8 JavaScript engine. No exploit code or technical details are provided.
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H