29 lines
No EOL
975 B
Text
29 lines
No EOL
975 B
Text
Specially crafted webdav request allows reading of local files on liferay 6.0.x
|
|
|
|
Description:
|
|
|
|
Liferay Portal is an enterprise portal written in Java
|
|
|
|
By creating a specially crafted webdav request that contains an
|
|
external entity it is possible to read files from a liferay server.
|
|
and echo these back in the response. You could use this for instance
|
|
to download configuration files containing database passwords or ssh
|
|
keys located in a users home folder
|
|
|
|
Proof of concept:
|
|
|
|
Code demonstrating the vulnerability can be found at
|
|
|
|
https://github.com/jelmerk/LPS-24562-proof
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18763.tar.gz
|
|
|
|
Systems affected:
|
|
|
|
Liferay 6.0.5 ce is confirmed to be vulnerable
|
|
Liferay 6.0.6 ce is confirmed to be vulnerable
|
|
|
|
Vendor status :
|
|
|
|
Liferay was notified januari 2 2012 by filing a bug in their public
|
|
bugtracker under issue number LPS-24562. The issue has since been
|
|
flagged as private and has been resolved. |