[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Liferay 6.0.x Webdav File Reading Vulnerability
# Published : 2012-04-22
# Author :
# Previous Title : Sysax 5.53 SSH Username Buffer Overflow (msf)
# Next Title : McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability
Specially crafted webdav request allows reading of local files on liferay 6.0.x
Description:
Liferay Portal is an enterprise portal written in Java
By creating a specially crafted webdav request that contains an
external entity it is possible to read files from a liferay server.
and echo these back in the response. You could use this for instance
to download configuration files containing database passwords or ssh
keys located in a users home folder
Proof of concept:
Code demonstrating the vulnerability can be found at
https://github.com/jelmerk/LPS-24562-proof
http://www.exploit-db.com/sploits/18763.tar.gz
Systems affected:
Liferay 6.0.5 ce is confirmed to be vulnerable
Liferay 6.0.6 ce is confirmed to be vulnerable
Vendor status :
Liferay was notified januari 2 2012 by filing a bug in their public
bugtracker under issue number LPS-24562. The issue has since been
flagged as private and has been resolved.