{
  "Name": "Liferay Portal Java Unmarshalling via JSONWS RCE (CVE-2020-7961)",
  "Description": "Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).",
  "Product": "Liferay-Portal",
  "Homepage": "https://portal.liferay.dev",
  "DisclosureDate": "2020-03-20",
  "Author": "gobysec@gmail.com",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/LiferayPortal/CVE-2020-7961/Liferay_Portal_JSONWS_RCE_CVE_2020_7961.gif",
  "FofaQuery": "app=\"Liferay\" || header=Liferay-Portal",
  "GobyQuery": "app=\"Liferay\" || header=Liferay-Portal",
  "Level": "3",
  "Impact": "An unauthenticated attacker can reach a Deserialization of Untrusted Data vulnerability that can allow them to execute arbitrary code.",
  "Recommendation": "Download update from: https://portal.liferay.dev/learn/security/known-vulnerabilities",
  "References": [
    "http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html",
    "https://portal.liferay.dev/learn/security/known-vulnerabilities",
    "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-7961",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7961"
  ],
  "HasExp": true,
  "ExpParams": null,
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2020-7961"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}