MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal

An issue was discovered in Liferay - Portal <=7.4.3.12-ga12. By inserting malicious content in the FTL Templates, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and perform SSRF (Server-Side Request Forgery), read arbitrary files and/or obtain RCE (Remote Code Execution).

Note: This issue exists because of an incomplete fix for CVE-2020-13445.

Why no CVE?

Liferay is part of the MITRE CNAs program and have decided that, because of the user privileges required to exploit the SSTI, the vulnerability does not represent a high enough risk to warant a CVE or a security advisory.

Requirements:

This vulnerability requires:

• Valid user credentials with the role "Power User", "Site Administrator" or "Site Owner"

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Resources:

Initial vulnerability (CVE-2020-13445) and by that inspired the SSTI research and finding of this vulnerability.