Skip to Content

Changes for page Application_Liferay

Last modified by Nicolas Gregoire on 2012/04/19 14:05
From version Icon 10.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 14:08
Change comment: There is no comment for this version
To version Icon 9.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 14:08
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -1,5 +1,12 @@
1 1  Dixit [[Wikipedia>>http://en.wikipedia.org/wiki/Liferay||rel="__blank"]] : //"Liferay Portal is a free and open source enterprise portal written in Java and distributed under the GNU Lesser General Public License.[2] and proprietary licenses. It is primarily used to power corporate intranets and extranets. [...] Liferay Portal is Java based and runs on any computing platform capable of running the Java Runtime Environment and an application server. Liferay is available bundled with an servlet container such as Apache Tomcat."//
2 2  
3 +
4 +
5 +
6 +
7 +
8 +
9 +
3 3  == Java code execution ==
4 4  
5 5  LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is [[Xalan-J>>Engine_Saxon]] (but this can probably modified easily using [[JAXP>>http://en.wikipedia.org/wiki/Java_API_for_XML_Processing||rel="__blank"]]). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : [[CVE-2011-1571>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1571||rel="__blank"]].