Expression Language Injection (CVE‑2018‑14667) in Red Hat JBoss RichFaces Framework Allows Remote Code Execution
What It Is — The RichFaces UI component library for JBoss contains an expression‑language injection flaw in the UserResource endpoint. An attacker can supply crafted Java‑serialized objects that the server evaluates, leading to arbitrary code execution.
Exploitability — Remote and unauthenticated; a proof‑of‑concept chain exists, but no public exploit has been observed. CVSS v3.1 ≈ 9.0 (High).
Affected Products — Red Hat JBoss RichFaces Framework (all versions prior to the Red Hat security advisory that introduced the fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for application‑security controls (secure coding, input validation, and component hardening) that map to a single VCF control objective and satisfy many frameworks (e.g., NIST CSF 2.0).
- Continuous monitoring of third‑party libraries and evidence of timely patching are essential to prove due‑diligence to auditors and enterprise buyers.
- A defensible audit trail—showing inventory, vulnerability scans, and remediation tickets—helps maintain trust when regulators or partners request proof of control effectiveness.
Recommended Actions
- Apply Red Hat’s patch for CVE‑2018‑14667 immediately.
- Update your component inventory and run a Software‑Composition Analysis (SCA) scan to confirm no vulnerable RichFaces versions remain.
- Incorporate automated testing for expression‑language injection in your CI/CD pipeline and capture remediation evidence for audit purposes.
Source: CISA KEV – CVE‑2018‑14667