An improper input sanitization flaw was found in the way JBoss Seam web application framework processed certain parametrized JBoss Expression Language expressions. A remote attacker could use this flaw to execute arbitrary code via a URL, containing appended, specially-crafted expression language parameters, provided to certain applications based on the JBoss Seam framework. Note: A properly configured and enabled Java Security Manager would prevent exploitation of this flaw.

References: [1] http://seamframework.org/ [2] http://docs.jboss.org/seam/2.2.0.GA/en-US/html/elenhancements.html

Acknowledgements:

Red Hat would like to thank Meder Kydyraliev of Google Security Team for responsibly reporting this issue.