""ET WEB_SPECIFIC_APPS Liferay Unauthenticated RCE via JSONWS Inbound (CVE-2020-7961)""

SID: 2031592

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Server, created_at 2021_01_29, cve CVE_2020_7961, deployment Perimeter, deployment Internal, signature_severity Major, updated_at 2021_01_29

Reference:

  • cve

  • 2020-7961

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/api/jsonws/"

  • Value: ".c3p0.WrapperConnectionPoolDataSource"

  • Value: "&defaultData.userOverridesAsString=HexAsciiSerializedMap|3a|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_client_body

  • http_client_body

source