Vulnerability in Liferay 6.2 CE GA2

RE: Vulnerability in Liferay 6.2 CE GA2

2020-04-29T07:48:28Z

Dominik Marks has an excellent blog article on this: https://liferay.dev/blogs/-/blogs/creating-liferay-security-binary-patches

RE: Vulnerability in Liferay 6.2 CE GA2

2020-04-09T16:49:35Z

Hi Saurabh,You can access the JSON services by the following URL:
http://localhost:8080/api/jsonws

We can't provide the steps to reproduce due to security reasons, contact Support if you have the EE version.
I hope this helps.

RE: Vulnerability in Liferay 6.2 CE GA2

2020-04-03T12:13:51Z

I have add the Patch related to the JSON WebService for "vulnerability CVE-2020-7961" issue in Liferay 6.2 GA2.
How can I test whether issue is resolved? Is there any JSON webservice API request by which i can test.

RE: Vulnerability in Liferay 6.2 CE GA2

2020-04-01T08:54:58Z

I am not sure, which classes are affected.
AFAIK the issue can be exploited only through the /api/jsonws/ services. So, what we did, when the issue was revealed, we blocked access to that path on the reverse proxy till we could apply a patch. Please note that this can have some side effects, since some services simple are not available anymore. e.g. categorization/tagging of content wasn't possible anymore afterwards.
Then we allowed specific IPs to access that url to allow the editors to do their work.
I guess, you could be able to do something similar. If these external IPs do not need any of the affected services (most don't need /api/jsonws), you could simple block access to them from the outside.

RE: Vulnerability in Liferay 6.2 CE GA2

2020-03-31T15:04:00Z

Our Liferay version is Liferay 6.2 GA2 and the patch is available for GA6. So We are planning to check if any of the classes in the below packages (which are used for Webservices) are present in the patch.
- portal-impl/src/com/liferay/portal/json/
- portal-impl/src/com/liferay/portal/jsonwebservice
If a class is present we will have to modify that class as per the changes in the patch.
Also in our case the Webservices are accessible only from our select Servers as mentioned below so this could be another level of safety.

RE: Vulnerability in Liferay 6.2 CE GA2

2020-03-31T13:06:44Z

Thanks Olaf Kock for quick reply.
But one thing is, we have restricted our Webservices to specific IPs , So is there any chances of unwanted (outsider IPs) attack through JSON Webservices as mentioned in "vulnerability CVE-2020-7961"
And Upgrading to GA6 would be a big task for us!

RE: Vulnerability in Liferay 6.2 CE GA2

2020-03-31T12:44:26Z

Saurabh Khandelwal:

# So my Questions are: 1. Should I apply patch for My Liferay 6.2 CE GA2 instance? If Yes then how to apply patch? as the patch is only available for 6.2 GA6.
2. And If applied the patch then how to test it?

The patch is for GA6, so you can't apply it to GA2. You should upgrade to GA6, then apply the patch. There are more issues (potentially security issues as well(?)) fixed in GA versions, and you should always be on the latest GA. Up until 7.2 typically no new features were introduced in newer GAs, just issues fixed. And often, the release of a new major version also means the end of updates for earlier major versions (with notable exceptions like this patch).
An alternative is to look at the patched components, and what changed between GA2 and GA6 to validate if you're in a situation where the patch indeed hits classes that were unchanged between GA2 and 6. But that's never been tested, it's comparable with looking at the changed code, then backporting the change to your version.

Vulnerability in Liferay 6.2 CE GA2

2020-03-31T12:39:05Z

Hello All,
I'm using Liferay 6.2 CE GA2.I got the notification regarding a vulnerability CVE-2020-7961 could be affected to Liferay System .
- Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
With Reference URL:

# So my Questions are:
1. Should I apply patch for My Liferay 6.2 CE GA2 instance? If Yes then how to apply patch? as the patch is only available for 6.2 GA6.
[https://github.com/community-security-team/liferay-portal/compare/6.2.5-ga6...6.2.5-cumulative.patch]
2. And If applied the patch then how to test it?