JVNDB-2015-001959

JBoss RichFaces vulnerable to remote Java code execution

JBoss RichFaces contains a remote Java code execution vulnerability.

JBoss RichFaces is an Ajax-enabled component library for JavaServer Faces (JSF). JBoss RichFaces contains a flaw in parsing the do parameter, which may result in arbitrary Java code execution.

Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Red Hat, Inc.

• JBoss RichFaces versions prior to 4.5.4

When a specially crafted input is processed, arbitrary Java code may be executed on the application server.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Red Hat, Inc.

• GitHub : RF-13977: prevent EL expression from executing methods
• JBoss Community : RichFaces RichFaces 4.5.4.Final Release Announcement
• JBoss Community : Stable Downloads
• JBoss Issue Tracker : RF-13977: Remote Command Injection (EL Injection)
• Red Hat Security Advisory : Important: Red Hat JBoss Web Framework Kit 2.7.0 security update

1. Code Injection(CWE-94) [IPA Evaluation]

1. CVE-2015-0279

1. JVN : JVN#56297719
2. National Vulnerability Database (NVD) : CVE-2015-0279
3. IPA SECURITY ALERTS : Security Alert for Vulnerability in JBoss RichFaces (JVN#56297719) (in Japanese)

• [2015/04/14]
    Web page was published