CVE-2019-11444

published 2019-04-22

CVE-2019-11444: An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed…

Priority P3 55 high 7.2 CVSS 3.0

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw

Affected

1 ranges

Vendor	Product	Version range	Fixed in
liferay	liferay_portal	—	—

Detection & IOCs extracted from sources · hover to see the quote

url group/control_panel/manage?p_p_id=com_liferay_server_admin_web_portlet_ServerAdminPortlet&p_p_lifecycle=1&p_p_state=maximized&p_p_mode=view&_com_liferay_server_admin_web_portlet_ServerAdminPortlet_javax.portlet.action=%2Fserver_admin%2Fedit_server↗

url group/control_panel/manage?p_p_id=com_liferay_server_admin_web_portlet_ServerAdminPortlet&p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view&_com_liferay_server_admin_web_portlet_ServerAdminPortlet_mvcRenderCommandName=%2Fserver_admin%2Fview&_com_liferay_server_admin_web_portlet_ServerAdminPortlet_tabs1=script↗

url web/guest/home?p_p_id=com_liferay_login_web_portlet_LoginPortlet&p_p_lifecycle=1&p_p_state=exclusive&p_p_mode=view&_com_liferay_login_web_portlet_LoginPortlet_javax.portlet.action=%2Flogin%2Flogin&_com_liferay_login_web_portlet_LoginPortlet_mvcRenderCommandName=%2Flogin%2Flogin↗

port 8080↗

cookie JSESSIONID↗

other ServerAdminPortlet_script↗

other Liferay-Portal↗

other Liferay.authToken↗

• → Detect POST requests to the Liferay Server Admin Groovy script execution endpoint with the action parameter set to /server_admin/edit_server, which is the trigger for RCE via the Groovy console. ↗
• → Alert on HTTP responses containing the 'Liferay-Portal' header advertising version 7.x or 6.x, as the exploit fingerprints the target using this header before proceeding. ↗
• → Monitor POST body content to the ServerAdminPortlet script endpoint for the presence of 'def cmd =' or '[command].execute()' patterns, which are the Groovy OS command execution constructs used in exploitation. ↗
• → Detect multipart/form-data POST requests to the Liferay control panel script tab URL (tabs1=script), which is used to access the Groovy console prior to payload submission. ↗
• → Flag exploitation attempts using reverse shell payloads (perl, python, ruby, sh) delivered via the Groovy console; the exploit explicitly constructs payloads using these interpreters. ↗

• · The Groovy script console is an intentional administrative feature, not a vulnerability by design. The developer disputes this CVE. Detection will generate false positives for legitimate administrator use of the Groovy console. ↗
• · Exploitation requires valid application administrator credentials; unauthenticated access is not possible. Detections should be scoped to authenticated sessions accessing the ServerAdminPortlet script endpoint. ↗
• · The Metasploit module defaults to port 8080 but the Liferay portal may be deployed on any port (e.g., 80/443). Detection rules should not be port-restricted to 8080 alone. ↗

CVSS provenance

nvd v3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78