Liferay 6.1 can be compromised in its default configuration

[Jelmer Kuperus <jelmer.advisories@xxxxxxxxx>]

Liferay 6.1 can be compromised in its default configuration

Description:

Liferay Portal is an enterprise portal written in Java

By utilizing the json webservices exposed by the platform you can
register a new user with any role in the system, including the built
in administrator role.
The problem lies in the addUser method of UserServiceUtil which
accepts a roleIds parameter. There are no checks on whether the
calling user has rights to assign this role. User self-registration
needs to be enabled on the portal to execute this attack.

Proof of concept:

Code demonstrating the vulnerability can be found at

https://github.com/jelmerk/LPS-26705-proof

Systems affected:

Liferay 6.1 ce is confirmed to be vulnerable
Liferay 6.1 ee is most likely vulnerable
Liferay 6 is probably only vulnerable when soap,hessian,burlap or
httpinvoker services are available to the attacker

Vendor status :

Liferay  was notified april 15 2012 by filing a bug in their public
bugtracker under issue number LPS-26705. The issue has since been
flagged as private and has not yet been resolved.