
Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server
POC for the exploitation of CVE-2018-14667
PREREQUISITES
Demo App From : http://downloads.jboss.org/richfaces/releases/3.3.X/3.3.4.Final/richfaces-examples-3.3.4.Final.zip
Jboss 5.1.0.GA from JBOSS download archive : https://repository.jboss.org/sourceforge/
Jdk-6u45-linux-x64 from JAVA archive : https://www.oracle.com/java/technologies/javase-java-archive-javase6-downloads.html
EXPLOITATION
1 - Install Maven and modify Main.java with the command to execute
image
2 - Run Runer.bash
image
3- Before sending the payload, visit the index page of the photoalbum lab
image
4 - The command is executed succesfully
image
NOTE
The exploit was taken from here and modified to adapt to the JBOSS App Server serialization : https://pastebin.com/raw/YRKdatWv