High‑Risk Deserialization Vulnerability in Liferay Portal (CVE‑2020‑7961) Enables Remote Code Execution
What It Is
Liferay Portal’s JSON web‑service endpoint improperly deserializes attacker‑controlled data. By sending crafted JSON payloads, a remote adversary can trigger arbitrary Java code execution on the server. The flaw is classified as a High‑severity Remote Code Execution (RCE) issue (CVSS v3.1 base 8.8).
Exploitability
The vulnerability is exploitable over the network without authentication. Proof‑of‑Concept code has been published publicly, and the National Vulnerability Database (NVD) lists active exploitation as “unconfirmed” but the attack vector is trivial. Vendors have issued patches, but many deployments remain unpatched.
Affected Products
- Vendor: Liferay
- Product: Liferay Portal (all supported versions prior to the vendor‑released fix)
Why It Matters for Compliance & Audit Readiness
A successful RCE bypasses logical access controls, undermining the integrity of the entire portal environment. From a control‑assurance perspective this directly impacts Vendor‑Management Controls and Access Control (AC‑6, AC‑7) in NIST CSF. Demonstrating timely patch management, maintaining an up‑to‑date inventory of Liferay instances, and evidencing remediation actions are essential for a defensible audit trail and to satisfy continuous monitoring requirements under frameworks such as ISO 27001 and SOC 2.
Recommended Actions
- Map the control: Align the vulnerability to your Access‑Control and Vendor‑Management policies; record the gap in your control register.
- Patch promptly: Apply Liferay’s security update (or upgrade to the latest supported release) across all environments.
- Validate remediation: Conduct post‑patch testing of the JSON web‑service endpoints and verify that deserialization is hardened.
- Log and monitor: Enable detailed request logging for
/api/jsonws/*endpoints; set up alerts for anomalous payload sizes or unexpected Java class loading events. - Capture evidence: Archive patch deployment records, configuration snapshots, and log excerpts as part of your audit evidence package.
Source: https://nvd.nist.gov/vuln/detail/CVE-2020-7961