This advisory comes in response to the recent public announcement of a potential Server-Side Request Forgery (SSRF) vulnerability in Liferay Portal 7.0.4. The report talks about a perceived vulnerability for the pingback functionality in the blogs feature of the product.
You can find a detailed description of blog pingbacks on Wikipedia.
The purpose of this article is to provide more details about the potential impact area and the related risks.
Affected Products
- Liferay Digital Experience Platform 7.0
- Liferay Portal 6.1 and 6.2 EE
Vulnerability Information
The perceived vulnerability only applies to the blogs pingback functionality, which is also part of the Enterprise versions. It does not indicate an XML-RPC vulnerability in any other area of the products. The mentioned Liferay products have an explicit registry of allowed XML-RPC methods that can be executed through the /xmlrpc/* end point. The vulnerability identifies the fact that a URL may be attached to a comment that is added when a pingback request is executed. Out-of-the-box (OOTB), the only possible command to be executed through this channel is the blogs pingback capability. There is no way for users to perform arbitrary remote code executions.
Resolution
Please visit LSV 391: Security Vulnerability for more information.
Workaround
It is important to note that blog pingbacks explicitly allows for anonymous users to add comments to blogs. If you do not desire this capability for your blog, there is a setting in portal.properties that explicitly disables pingbacks. Specifically, set the value of blogs.pingbacks.enabled=false in your portal-ext.properties.