Joao Filho Matos Figueiredo

The RichFaces Framework is susceptible to Expression Language (EL) injection through the UserResource resource. A remote, unauthenticated attacker can potentially execute arbitrary code by exploiting a chain of Java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`. This issue is currently being exploited in attacks, as indicated by CISA advisories.

The issue allows remote attackers to execute arbitrary code via crafted serialized data due to a lack of restriction on the classes for which deserialization is performed in the JMS over HTTP Invocation Layer of the JbossMQ implementation.