Specially crafted webdav request allows reading of local files on liferay 6.0.x

vendor:

Liferay Portal

by:

Jelmerk

7,5

CVSS

HIGH

External Entity Injection

611

CWE

Product Name: Liferay Portal

Affected Version From: Liferay 6.0.5 ce

Affected Version To: Liferay 6.0.6 ce

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Specially crafted webdav request allows reading of local files on liferay 6.0.x

By creating a specially crafted webdav request that contains an external entity it is possible to read files from a liferay server and echo these back in the response. You could use this for instance to download configuration files containing database passwords or ssh keys located in a users home folder.

Mitigation:

Upgrade to the latest version of Liferay Portal.

Source

Exploit-DB raw data:

Specially crafted webdav request allows reading of local files on liferay 6.0.x

Description:

Liferay Portal is an enterprise portal written in Java

By creating a specially crafted webdav request that contains an
external entity it is possible to read files from a liferay server.
and echo these back in the response. You could use this for instance
to download configuration files containing database passwords or ssh
keys located in a users home folder

Proof of concept:

Code demonstrating the vulnerability can be found at

https://github.com/jelmerk/LPS-24562-proof
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18763.tar.gz

Systems affected:

Liferay 6.0.5 ce is confirmed to be vulnerable
Liferay 6.0.6 ce is confirmed to be vulnerable

Vendor status :

Liferay was notified januari 2 2012 by filing a bug in their public
bugtracker under issue number LPS-24562. The issue has since been
flagged as private and has been resolved.