---
id: 7437
title: "[CVE-2013-2165] When EL Injection meets Java Deserialization"
cve: CVE-2013-2165
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/when-el-injection-meets-java-deserialization/"
published_at: "2018-09-18T08:57:00Z"
tags: ["rce", "zero-day", "java", "deserialization", "exploit-development", "el-injection", "cve-2018-12532", "richfaces"]
phying_url: "https://phying.com/item/7437"
lang: en
---

# [CVE-2013-2165] When EL Injection meets Java Deserialization

## Summary

Exploit development for RichFaces 4 CVE-2018-12532, chaining EL injection into Java deserialization and bypassing library restrictions to achieve reliable RCE on JSF applications.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2013-2165
- **Published:** 2018-09-18T08:57:00Z
- **Original:** https://blog.viettelcybersecurity.com/when-el-injection-meets-java-deserialization/
- **Phying News:** https://phying.com/item/7437