Patchfirst
Patchfirst
CVE-2017-1000486 KEVPublic exploit Critical · 9.8 EPSS 94.1%

Primetek Primefaces Remote Code Execution Vulnerability

Primetek · Primefaces Application

Summary

Primetek's Primefaces Application, in version 5.x, contains an inadequate encryption strength flaw (CWE: Inadequate Encryption Strength). An unauthenticated attacker with network access can exploit it without any user interaction to achieve remote code execution.

Official description · NVD

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Breakdown
69.8 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 3 years after disclosure. Public exploit code (Metasploit) was available 23 months before disclosure.

  1. Public exploit codeMetasploit23 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+3 yrs
  4. Added to CISA KEVEU database agrees+4 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Remote unauthenticated exploit of public-facing application

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Successful exploitation yields arbitrary code execution

resulting in remote code execution
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2017-1000486 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.primefaces:primefaces.

Mavenorg.primefaces:primefacesGHSA-j239-4gqg-5j54

Upgrade to 6.0 or later

Set the version to 6.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2017-1000486. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
5.0 up to 6.06.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

5 links, grouped by NVD tag (4 duplicates merged)

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000486

Third Party Advisory 4

blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.htmlcryptosense.com/weak-encryption-flaw-in-primefaces/github.com/primefaces/primefaces/issues/1152exploit-db.com/exploits/43733/
↑ ↓ chooseEnter openEsc close