CVE-2020-7961
Liferay Portal Deserialization of Untrusted Data Vulnerability
Description
CVE-2020-7961 is a critical deserialization of untrusted data vulnerability in Liferay Portal prior to version 7.2.1 CE GA2 with a CVSS score of 9.8. The vulnerability exists in the JSON Web Services (JSONWS) endpoint, which improperly deserializes user-supplied data. A remote unauthenticated attacker can exploit this flaw by sending specially crafted serialized Java objects to the JSONWS API, leading to arbitrary code execution on the server. This vulnerability has been actively exploited in the wild, including by the FreakOut botnet campaign, and requires no authentication or user interaction to exploit. The high EPSS score of 0.943 (99.9th percentile) reflects the widespread availability of public exploit code and the ease of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| liferay | liferay portal | < 7.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://portal.liferay.dev/learn/security/known-vulnerabilities(Broken Link, Vendor Advisory)
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271(Broken Link, Vendor Advisory)
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 occurs when an application deserializes data from an untrusted source without proper validation, allowing attackers to manipulate serialized objects to execute arbitrary code, cause denial of service, or perform other malicious actions. In CVE-2020-7961, Liferay Portal's JSONWS endpoint deserializes attacker-controlled Java objects without adequate safeguards, enabling remote code execution through crafted serialization payloads.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2020-7961 is critical, with a CVSS score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and achieves High impact across confidentiality, integrity, and availability. Successful exploitation grants the attacker complete control over the Liferay Portal server, allowing them to execute arbitrary commands, access or modify all application data, install backdoors, and potentially pivot to other systems on the network. Given that Liferay Portal is often used as an enterprise content management and collaboration platform, a compromise can expose sensitive corporate data, user credentials, and internal communications.
Exploit Maturity
CVE-2020-7961 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021. The EPSS score of 0.943 (99.9th percentile) indicates an extremely high exploitation probability. Multiple public exploits are available, including detailed proof-of-concept code on Packet Storm Security. The vulnerability was notably leveraged by the FreakOut botnet campaign documented by Check Point Research, which used it alongside other vulnerabilities to build a botnet for cryptomining and DDoS attacks.
Remediation
- Update Liferay Portal to version 7.2.1 CE GA2 or later immediately, as this version contains the official fix for the deserialization vulnerability in the JSONWS endpoint.
- Restrict access to JSONWS endpoints by configuring web application firewall rules or reverse proxy configurations to block or limit access to /api/jsonws paths from untrusted networks.
- Implement Java deserialization filters using JEP 290 (serialization filtering) to restrict which classes can be deserialized, even if other deserialization vulnerabilities exist.
- Review server logs for suspicious JSONWS requests, particularly those containing unusual serialized Java object payloads or unexpected class references.
- Conduct a thorough compromise assessment on any Liferay Portal instances that were running vulnerable versions exposed to the internet, looking for web shells, unauthorized accounts, and cryptomining malware.
- Apply network segmentation to limit the Liferay Portal server's access to internal resources and databases, reducing the potential blast radius of a compromise.
Technical Details
The vulnerability is rooted in Liferay Portal's JSON Web Services (JSONWS) framework, which provides a RESTful API for interacting with portal services. The JSONWS endpoint at /api/jsonws accepts serialized Java objects as part of API requests. Prior to version 7.2.1 CE GA2, the deserialization process did not implement adequate class filtering or validation, allowing an attacker to submit arbitrary Java objects. By crafting a malicious serialized object using known Java deserialization gadget chains (such as those from Apache Commons Collections or other libraries present on the classpath), an attacker can achieve remote code execution. The attack requires only network access to the JSONWS endpoint and no authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms the straightforward nature of the exploit. Public exploit code demonstrates the full attack chain from crafting the serialized payload to achieving command execution on the target system.
Frequently Asked Questions
Is CVE-2020-7961 being actively exploited?
Yes. CVE-2020-7961 has been actively exploited in the wild, most notably by the FreakOut botnet campaign documented by Check Point Research. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Multiple public exploits are available, making this vulnerability accessible to a wide range of threat actors.
What products are affected by CVE-2020-7961?
Liferay Portal versions prior to 7.2.1 CE GA2 are affected. The vulnerability specifically exists in the JSON Web Services (JSONWS) endpoint, which is enabled by default in Liferay Portal installations.
How do I fix CVE-2020-7961?
Update Liferay Portal to version 7.2.1 CE GA2 or later. Additionally, restrict network access to the /api/jsonws endpoint, implement Java deserialization filters, and review server logs for signs of exploitation.
How severe is CVE-2020-7961?
With a CVSS score of 9.8 (Critical), CVE-2020-7961 is extremely severe. It allows unauthenticated remote attackers to execute arbitrary code on the Liferay Portal server, potentially leading to complete system compromise. The EPSS score of 0.943 places it in the 99.9th percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.