CVE-2020-15842

Vulnerability

Overview

CVE-2020-15842 is an insecure deserialization vulnerability found in Liferay Portal versions before 7.3.0, and in Liferay DXP versions 7.0 (before fix pack 90), 7.1 (before fix pack 17), and 7.2 (before fix pack 5). The issue stems from the application's failure to properly validate serialized data, allowing a remote attacker to execute arbitrary code [1].

Attack

Vector

An attacker with man-in-the-middle network position can exploit this flaw by sending a crafted serialized payload to the vulnerable Liferay server. The attack does not require authentication, but relies on the attacker being able to intercept or modify network traffic between the client and server, or directly send malicious requests to the server if network access is available [1].

Impact

Successful exploitation results in arbitrary code execution in the context of the Liferay application server. This gives the attacker full control over the affected system, including the ability to read, modify, or delete sensitive data, install malware, or pivot to other internal systems. The CVSS score for this vulnerability is 9.8 (Critical), indicating a severe impact on confidentiality, integrity, and availability [1].

Mitigation

Liferay has released fixes for the affected versions: Liferay Portal 7.3.0 and Liferay DXP fix packs 90 (7.0), 17 (7.1), and 5 (7.2). Users are strongly advised to upgrade their installations to these patched versions or apply the respective fix packs. For environments that cannot be immediately upgraded, restricting network access and implementing strong network segmentation can reduce the risk of man-in-the-middle attacks [1][2].