CVE-2020-13445 : What You Need to Know

Liferay Portal and Liferay DXP versions before specified fix packs are vulnerable to remote code execution due to unrestricted user access in the template API.

Understanding CVE-2020-13445

This CVE highlights a security vulnerability in Liferay Portal and Liferay DXP versions that could allow remote authenticated users to execute arbitrary code through specially crafted templates.

What is CVE-2020-13445?

In Liferay Portal versions before 7.3.2 and Liferay DXP versions before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API lacks proper restrictions on user access to sensitive objects, enabling attackers to run malicious code using manipulated FreeMarker and Velocity templates.

The Impact of CVE-2020-13445

The vulnerability poses a significant risk as it allows remote authenticated users to execute arbitrary code, potentially leading to unauthorized access, data breaches, and system compromise.

Technical Details of CVE-2020-13445

Liferay Portal and Liferay DXP versions are affected by this vulnerability, impacting the security of the systems utilizing these platforms.

Vulnerability Description

The issue arises from the template API's failure to enforce restrictions on user access to sensitive objects, creating an avenue for remote code execution.

Affected Systems and Versions

Liferay Portal versions before 7.3.2
Liferay DXP 7.0 before fix pack 92
Liferay DXP 7.1 before fix pack 18
Liferay DXP 7.2 before fix pack 6

Exploitation Mechanism

Attackers can exploit this vulnerability by crafting malicious FreeMarker and Velocity templates, allowing them to execute arbitrary code on the affected systems.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent the exploitation of CVE-2020-13445.

Immediate Steps to Take

Apply the necessary security patches provided by Liferay for the affected versions.
Monitor system logs and user activities for any suspicious behavior.
Restrict access to the template API to authorized personnel only.

Long-Term Security Practices

Regularly update and patch Liferay Portal and Liferay DXP to mitigate known vulnerabilities.
Conduct security audits and assessments to identify and address potential security gaps.

Patching and Updates

Ensure timely installation of security patches and updates released by Liferay to safeguard systems against CVE-2020-13445.