Executive brief
Liferay Portal, a widely used enterprise collaboration and content management platform, contains a security flaw in its file processing component. An attacker can exploit this to access sensitive files on the underlying server, such as configuration files or system passwords. This could lead to a complete compromise of the server and the data stored within the portal.
Technical details
A directory traversal vulnerability exists in Liferay Portal 5.1.0 within the 'barebone.jsp' component. The issue resides in the 'minifierBundleDir' parameter, which fails to properly sanitize input containing encoded path traversal sequences. An unauthenticated remote attacker can use URL-encoded 'dot-dot-slash' characters (%2E%2E/) combined with a null byte (%00) and a trailing '.html' extension to bypass validation and access arbitrary files on the host operating system, such as /etc/hosts. Successful exploitation can result in full information disclosure and potential system compromise.
Affected products
- Liferay Liferay Portal 5.1.0
Timeline
- 2016-08-01: disclosed: Vulnerability details shared on oss-security mailing list
- 2017-01-23: advisory: NVD published the CVE record