CVE-2020-15840

The vulnerability resides in the property portlet.resource.id.banned.paths.regexp, which is intended to block access to sensitive paths such as /META-INF and /WEB-INF. Due to insufficient input validation, an attacker can bypass this regex filter by supplying a double-encoded URL, effectively circumventing the security control [1][3].

To exploit the flaw, an attacker sends a specially crafted HTTP request to a portlet resource with a double-encoded path. No authentication is required, and the attack can be performed remotely over the network [3]. The double encoding causes the server to decode the URL twice, allowing the banned path to be interpreted as a legitimate resource identifier.

Successful exploitation grants an attacker access to restricted portlet resources, including files within the /META-INF and /WEB-INF directories. This can expose sensitive configuration files, application internals, and potentially lead to further compromise of the Liferay instance [3].

Liferay has addressed the issue in versions 7.3.1, 7.1.3 (for DXP 7.1), and 7.4.0. Users are advised to upgrade to these or later releases. Liferay Portal 6.2 EE is also affected but may be end-of-life, so upgrading to a supported version is strongly recommended [3].