CVE-2020-7961
Published: 20 March 2020
Summary
CVE-2020-7961 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Liferay Liferay Portal. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-7961 is a deserialization of untrusted data vulnerability, tracked under CWE-502, that affects Liferay Portal versions prior to 7.2.1 CE GA2. The flaw resides in the JSON web services (JSONWS) component and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
Unauthenticated remote attackers can supply crafted serialized payloads to the JSONWS endpoints, triggering arbitrary code execution on the server and resulting in full compromise of confidentiality, integrity, and availability.
Liferay security advisories list the issue among known vulnerabilities and indicate that the defect is resolved by upgrading to version 7.2.1 CE GA2 or later releases that contain the corresponding patch.
Public exploit code has been published on PacketStorm, and the vulnerability was observed being leveraged in the FreakOut campaign to assemble a botnet from unpatched Liferay instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-5527
Vulnerability details
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (including serialized JSON payloads) before processing, blocking the untrusted deserialization that enables RCE in JSONWS endpoints.
Mandates timely installation of vendor patches that eliminate the deserialization flaw, exactly as required to move from vulnerable Liferay versions to 7.2.1 CE GA2 or later.
Deploys malicious-code detection mechanisms that can identify and block execution of deserialized payloads delivered through the JSONWS attack vector.