An unauthenticated server-side Expression Language injection vulnerability in the OmniFaces utility library allows remote attackers to achieve Remote Code Execution via crafted resource requests.

This flaw is an Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917), triggered when using CDNResourceHandler with a wildcard mapping where unauthenticated attackers can supply an evaluated EL expression in a resource request URL.

A successful exploit grants an attacker complete control over the underlying server, resulting in total compromise of confidentiality, integrity, and availability. Although the CVSS score is 8.1 due to attack complexity requirements, the potential impact is catastrophic because it leads directly to arbitrary code execution within the application context.

Immediate Action: Update the OmniFaces library to version 1.14.2, 2.7.32, 3.14.16, 4.7.5, 5.2.3, or later depending on your active branch.

Proactive Monitoring: Monitor application access logs for suspicious resource request URLs containing unexpected expression syntax or function calls indicative of EL injection attempts.

Compensating Controls: Implement strict Web Application Firewall rules to inspect incoming resource request parameters and block requests containing Expression Language delimiters.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in the tracked intelligence sources.

Given the severe impact of Remote Code Execution, administrators must prioritize updating the OmniFaces library across all affected Java applications immediately. Review application configurations to ensure wildcard CDN resource handlers are either patched or properly restricted if immediate patching is delayed.