Issue
Why /o/marketplace-app-manager-web/icon.jsp is public by default?
- Are there any other out of the box resources publicly available by default?
Environment
- Liferay DXP any
Resolution
- The Marketplace module is an out-of-the-box Liferay module.
- As long as it remains deployed (e.g. not explicitly undeployed), its endpoints will continue to be publicly accessible.
- There was a known vulnerability in this module, addressed by LPD-46038
-
To prevent public access to its endpoints, you have three main options:
- Implement a custom servlet filter for authentication and authorisation
- Implement firewall rules
-
Apply access control rules at the web server level, for example:
location ~ ^/o/marketplace-app-manager-web/ { deny all; }
- By default, any JSP, static file, or servlet located in a module’s
META-INF/resourcesdirectory is automatically exposed at the path/o/{servletContextName}/. - These files are out of the box OSGi servlet resources.
- This means that files under the
META-INF/resourcesfolder of a deployed Liferay module are publicly available by default under/o/{module-name}/ -
Examples from built-in modules:
/o/fragment-web/resources/resource.jsp/o/frontend-theme-classic/images/logo.png