Liferay Portal Deserialization Vulnerability Leading to Remote Code Execution

A deserialization vulnerability allowing remote code execution has been identified in Liferay Portal versions prior to 7.2.1 CE GA2. This vulnerability arises from the insecure handling of data in the JSON web services interface, allowing attackers to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for unauthorized remote code execution on the server, with the executed code running under the context of the Liferay user.

Reproduction

The vulnerability can be reproduced by sending a crafted JSON object that, when deserialized, triggers the execution of malicious code. This can be done using a Metasploit module designed for this purpose, which automates the exploitation process by uploading a malicious Java class that is executed on the server.

Remediation

Users are advised to update to Liferay Portal version 7.2.1 CE GA2 or later.