SNS Vulnerability

Liferay Portal Multiple Vulnerabilities

Description

(#Several vulnerabilities have been identified in Liferay Portal:#- CVE-2016-10404: cross-site scripting via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp##- CVE-2017-12645: cross-site scripting via an invalid portletId##- CVE-2017-12646: cross-site scripting via a login name, password, or e-mail address##- CVE-2017-12647: cross-site scripting via a Knowledge Base article title##- CVE-2017-12648: cross-site scripting via a bookmark URL##- CVE-2017-12649: cross-site scripting via a crafted title or summary that is mishandled in the Web Content Display##- denial of service. A remote attacker could exploit it in order to create a denial of service situation by using a crafted URL.##- denial of service via the editing of a wiki page. An authenticated remote attacker could exploit it in order to create a denial of service situation by using a form with crafted parameters##- path disclosure. A remote attacker could exploit it in order to get the path to all OSGi bundles by using a crafted URL.#Updated, 08/08/2017:#An additional vulnerability, fixed by the same patches, was reported :#- CVE-2017-1000425: cross-site scripting via the "movie" parameter in "/html/portal/flash.jsp")

Vulnerable Products

Vulnerable Software:
Liferay (Liferay) - 7.0.3

Solution

Liferay Portal has released a patch.

CVE

CVE-2017-12649
CVE-2017-12648
CVE-2017-12647
CVE-2017-12646
CVE-2017-12645
CVE-2017-1000425
CVE-2016-10404

References

- Liferay: CST-7030 Multiple XSS vulnerabilities in 7.0 CE GA4
https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7030-multiple-xss-vulnerabilities-in-7-0-ce-ga4?inheritRedirect=false
- Liferay: CST-7028 Denial of service vulnerability via crafted URL
https://dev.liferay.com/fr/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7028-denial-of-service-vulnerability-via-crafted-url?inheritRedirect=false
- Liferay: CST-7029 Denial of service vulnerability via the editing of a wiki page
https://dev.liferay.com/fr/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7029-denial-of-service-vulnerability-via-the-editing-of-a-wiki-page?inheritRedirect=false
- Liferay: CST-7032 Paths to OSGi bundles exposed
https://dev.liferay.com/fr/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7032-paths-to-osgi-bundles-exposed?inheritRedirect=false
- Git : liferay-portal
https://github.com/liferay/liferay-portal/commit/9435af4ef8a90b5333da925a5ec860a43d18c031

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

High

Vulnerability First Public Report Date

2017-08-07

Target Type

Client

Possible exploit

Remote