Liferay 7.1.2 GA2 - targeted by malware

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-30T15:22:48Z

Davide del Vecchio:

Thank you, last question (I hope):
If I use the binary in the comments, what I need to do is just replace the tomcat and osgi folder?

Yes, you just have to unzip the provided patches into your installation, overwriting every file found. The server should be stopped before. Afterwards it is recommended to clear some directories, so that no cached files or cached settings cause problems. That means, clear the following directories (if present):

bundles\osgi\state
bundles\tomcat-9.0.17\temp
bundles\tomcat-9.0.17\work
bundles\work

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-30T13:58:51Z

I think, you use the wrong term here. At least for me CORS means "Cross-Origin Resource Sharing". CORS has nothing to do with this.
But allowing only certain IPs to access /api/jsonws should work, since attackers would have to attack from those IPs. Of course, it would still be best to really patch the issue.

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-30T13:13:20Z

<p>What if I set CORS (for specific IPs that I need) instead of shutting down all the API ?</p>

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-30T13:11:39Z

Thank you, last question (I hope):
If I use the binary in the comments, what I need to do is just replace the tomcat and osgi folder?

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-29T06:58:31Z

Yes. You need to create the binary patches too (or download them from the blogpost, Dominik Marks has provided links in the comments)

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-28T21:10:30Z

So updating to GA4 doesn't solve it?
I need to create binary patches too?
Unfortunately I need to use jsonws.

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-28T18:43:58Z

Dominik Marks has already posted a link to his post "Creating Liferay Security Binary Patches".
Another way to protect your system is to block access to /api/jsonws completely. Please note that this could affect some functionality e.g. it isn't possible to select categories for content anymore afterwards. But if you don't need that and you have already a reverse proxy in front of Liferay, it is pretty easy to do that.

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-28T14:15:25Z

Thanks for the reply, i'm triying right now to upgrade to 7.1.3 GA4.

"apply the latest security patches"
How is it done?

RE: Liferay 7.1.2 GA2 - targeted by malware

2020-04-28T14:09:10Z

Hello Davide,

if you can you should upgrade to the latest Liferay version. If not, consider updating to the latest GA of 7.1 (which is 7.1.3 GA4) and apply the latest security patches.

The Liferay versions which are affected by the current exploit are mentioned in this blog post: https://liferay.dev/blogs/-/blogs/security-patches-for-liferay-portal-6-2-7-0-and-7-1

Also consider my own blog post on how to create binary patches for the source code patches mentioned in the blog post above: https://liferay.dev/blogs/-/blogs/creating-liferay-security-binary-patches

Liferay 7.1.2 GA2 - targeted by malware

2020-04-28T13:30:34Z

Hello,the server where the portal is running is getting targeted by a cryptocurrency malware (should I share the name?).
Can someone help me?What can I do to prevent this, where can I look?
Upgrading to a more recent version like GA4 can solve the prbolem or should I go with something newer like 7.2 or 7.3?

Please help