Arbitrary EL Evaluation in RichFaces

Description

RichFaces is one of the most popular component libraries for JavaServer Faces (JSF). In early 2016, the developers of RichFaces announced the end-of-life of RichFaces in June 2016.

The latest released versions of RichFaces (3.3.4 and 4.5.17) are affected by the following vulnerabilities:

RF-14310: Arbitrary EL Evaluation in RichFaces 3.x <= 3.3.4
Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource.

RF-14309: Arbitrary EL Evaluation in RichFaces 4.5.3 <= 4.5.17
Injection of arbitrary EL variable mapper allows to bypass mitigation of CVE-2015-0279 and thereby remote code execution.

Remediation

Mitigate these vulnerabilities by blocking requests to the affected URLs:
Blocking requests of URLs with paths containing /DATA/ should mitigate CVE-2013-2165 and RF-14310.
Blocking requests of URLs with paths containing org.richfaces.resource.MediaOutputResource (literally or URL encoded) should mitigate CVE-2015-0279 and RF-14309.