Known Issue: Security Scan Shows Liferay as a Potential Sharepoint Vulnerability - False Positive

Issue

There may be some instances where a security scan shows Liferay having a potential Sharepoint endpoint vulnerability. Specifically, the security scan's warning may be related to the /_vti_inf.html file. This is actually a false-positive considering Liferay is not a Sharepoint server.

Signs

• The security scan identifies a security issue with Liferay pertaining to the _vti_inf.html file
• Accessing http://localhost:8080/_vti_inf.html results in a page that displays:

  • <!-- FrontPage Configuration Information
     FPVersion="6.0.2.9999"
     FPShtmlScriptUrl="_vti_bin/shtml.dll/_vti_rpc"
     FPAuthorScriptUrl="_vti_bin/_vti_aut/author.dll"
     FPAdminScriptUrl="_vti_bin/_vti_adm/admin.dll"
     TPScriptUrl="_vti_bin/owssvr.dll"
     -->

Resolution

Since this is not necessarily a security risk, if you would like to block access to this file, you can perform the following steps:

• For DXP 7.4: Remove, or comment out, the following entries for Sharepoint Servlet from DXP's shielded-container-web.xml . For versions prior to DXP 7.4:  Remove, or comment out, the following entries for Sharepoint Servlet from DXP's web.xml

  • <servlet>
    <servlet-name>Sharepoint Servlet</servlet-name>
    <servlet-class>com.liferay.portal.sharepoint.SharepointServlet</servlet-class>
    <async-supported>true</async-supported>
    </servlet>

  • <servlet-mapping>
      <servlet-name>Sharepoint Servlet</servlet-name>
      <url-pattern>/_vti_inf.html</url-pattern>
     </servlet-mapping>
     <servlet-mapping>
      <servlet-name>Sharepoint Servlet</servlet-name>
      <url-pattern>/_vti_bin/shtml.dll/_vti_rpc</url-pattern>
     </servlet-mapping>
     <servlet-mapping>
      <servlet-name>Sharepoint Servlet</servlet-name>
      <url-pattern>/sharepoint/_vti_bin/_vti_aut/author.dll</url-pattern>
     </servlet-mapping>
     <servlet-mapping>
      <servlet-name>Sharepoint Servlet</servlet-name>
      <url-pattern>/sharepoint/_vti_bin/owssvr.dll</url-pattern>
     </servlet-mapping>

• Set com.liferay.portal.sharepoint.SharepointFilter=false in portal-ext.properties

Note: As the use of Patching Tool to update fixes will override the web.xml, please ensure that you verify that the desired changes are present before and after the patch operation.