CVE-2018-14667: RichFaces Framework EL injection enables unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, KEV listing, and very high EPSS probability.

What it is

RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language injection through the UserResource resource. A remote, unauthenticated attacker can chain Java serialized objects via org.ajax4jsf.resource.UserResource$UriData to execute arbitrary code. The flaw is critical because it is network-reachable, needs no credentials or user interaction, and leads to full compromise of the affected server.

Impact

An attacker gains arbitrary code execution on the application server, typically running with the privileges of the Java process. That allows full control of the host, data theft, and lateral movement into the surrounding environment.

Attack surface

Reachable over the network through the RichFaces UserResource endpoint; the CVSS vector shows no privileges required and no user interaction. Any internet- or network-exposed RichFaces 3.X application is directly in scope.

Exploitation

Listed in CISA KEV since 2023-09-28 with a required action deadline, and EPSS 30-day probability is about 0.74 (99.5th percentile), indicating active exploitation and high likelihood. Public exploitation tooling is referenced (Richsploit), though no ransomware use is documented.

What to do

• Apply the Red Hat errata fixes (RHSA-2018:3517, 3518, 3519, 3581) or upgrade RichFaces to a fixed release.
• If patching is not possible, discontinue use of the affected RichFaces 3.X component per CISA guidance.
• Restrict network access to RichFaces endpoints so only trusted clients can reach them.
• Deploy WAF or filtering rules to block EL injection and serialized-object payloads targeting UserResource.
• Inventory applications for embedded RichFaces 3.X libraries, including those bundled inside JBoss/Enterprise Linux deployments.

Detection

• Monitor web logs for requests to RichFaces UserResource paths containing EL expressions or serialized Java object markers.
• Alert on outbound connections or child processes spawned by the Java application server that are unusual for the workload.
• Search for known Richsploit or serialized-payload signatures in HTTP request bodies.
• Review application server logs for deserialization errors or unexpected class loading around org.ajax4jsf.resource.UserResource$UriData.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.