Liferay 6.0.x - WebDAV File Reading

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1063639 漏洞类型
发布时间 2012-04-22 更新时间 2012-04-22
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Multiple CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/18763
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
Specially crafted webdav request allows reading of local files on liferay 6.0.x

Description:

Liferay Portal is an enterprise portal written in Java

By creating a specially crafted webdav request that contains an
external entity it is possible to read files from a liferay server.
and echo these back in the response. You could use this for instance
to download configuration files containing database passwords or ssh
keys located in a users home folder

Proof of concept:

Code demonstrating the vulnerability can be found at

https://github.com/jelmerk/LPS-24562-proof
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/18763.tar.gz

Systems affected:

Liferay 6.0.5 ce is confirmed to be vulnerable
Liferay 6.0.6 ce is confirmed to be vulnerable

Vendor status :

Liferay was notified januari 2 2012 by filing a bug in their public
bugtracker under issue number LPS-24562. The issue has since been
flagged as private and has been resolved.