Loading vulnerability…
CVE-2020-7961 is a deserialization of untrusted data vulnerability in Liferay Portal prior to 7.2.1 CE GA2. The flaw is exposed through the JSON web services (JSONWS) component, where attacker-controlled serialized Java data can be unmarshalled by the application. By supplying a crafted malicious object to the vulnerable JSONWS functionality, a remote attacker can trigger unsafe Java deserialization and achieve arbitrary code execution on the target server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository is not a single exploit dropper but a focused vulnerability-research and validation project for Liferay Portal CE 7.0.3 GA4. Most files are Markdown research artifacts: inventory, threat model, prior art, candidate analyses, judge verdicts, and live-validation writeups. The actual code is concentrated in tools/gadget_ser.py and tools/liferay_ga4_check.py, which generate Java-serialization payloads in pure Python and automate validation of the documented findings. The main exploit capability is unauthenticated RCE against Liferay JSONWS (CVE-2020-7961 class). The documented and live-validated chain targets /api/jsonws/invoke or service-specific JSONWS methods, abuses parameter type override to instantiate com.mchange.v2.c3p0.WrapperConnectionPoolDataSource, sets userOverridesAsString to a HexAsciiSerializedMap payload, triggers ObjectInputStream.readObject(), and uses an AspectJWeaver gadget to write arbitrary files, including a JSP under the Tomcat ROOT webapp. The repo explicitly reports live end-to-end RCE as root. Beyond RCE, the repository documents multiple additional exploit primitives: pre-auth blind SSRF via /xmlrpc/pingback with internal port oracle behavior; pre-auth and authenticated arbitrary document-version disclosure via /o/sync/download/* using versionId IDOR; pre-auth image disclosure via /image/*?img_id=; pre-auth Web Content Display request-parameter override for cross-site article disclosure; authenticated XSL template SSRF/RCE and Velocity/Freemarker file/property disclosure; captcha brute-force and forgot-password abuse; and several conditional or deployment-specific issues involving poller, tunnel, Axis, OpenSocial, WSRP, SSO, and import/export. Repository structure is methodical: candidates/ contains initial vulnerability hypotheses by attack surface; judge/ contains independent source-based validation/refutation; verified/ contains live exploitation evidence and cleanup notes; ENTRYPOINTS.md and ENV.md define the target surface and lab environment; FINDINGS.md and REPORT.md summarize outcomes; tools/ contains the only operational exploit code. Overall, this is a mature operational research repo with actionable exploit intelligence, especially for default Liferay GA4 deployments.
This repository contains a single Metasploit module (modules/exploits/multi/http/liferay_java_unmarshalling.rb) that exploits a Java deserialization vulnerability (CVE-2020-7961) in Liferay Portal's JSONWS API. The exploit targets Liferay Portal versions prior to 6.2.5 GA6, 7.0.6 GA7, 7.1.3 GA4, and 7.2.1 GA2. The module first checks for the presence and version of Liferay by inspecting the 'Liferay-Portal' HTTP header at the root path ('/'). If the target is vulnerable, the exploit starts a remote classloader server and sends a malicious serialized Java object to the '/api/jsonws/expandocolumn/update-column' endpoint, leveraging a gadget chain (C3P0WrapperConnPool) to achieve remote code execution. The default payload is a Java Meterpreter reverse shell, but this can be customized. The exploit is operational and provides a shell as the Liferay user if successful. The code is written in Ruby and is designed to be used within the Metasploit framework.
This repository provides a mass exploitation toolkit for CVE-2020-7961, a remote code execution vulnerability in Liferay Portal. The main exploit logic is in rce.py, which targets the /api/jsonws/invoke endpoint using a crafted serialized Java payload to achieve command execution. The script detects the target OS (Linux or Windows) and saves results to linux.txt or win.txt. mass.py automates exploitation against multiple targets from a list, while shell.py offers an interactive shell-like interface for executing commands on a compromised host. The exploit is operational, providing real command execution, and is designed for ease of use by attackers. The README includes usage instructions, requirements, and search engine dorks for finding vulnerable targets.
This repository contains a Python exploit script (CVE-2020-7961.py) targeting CVE-2020-7961, a critical unauthenticated remote code execution vulnerability in Liferay Portal's JSONWS API. The exploit works by enumerating available API contexts and endpoints, identifying those that accept a 'java.lang.Object' input (which can be hijacked for deserialization attacks), and then sending a crafted serialized Java payload to the /api/jsonws/invoke endpoint. The script allows the user to specify a command to execute on the target server, leveraging the vulnerability to achieve arbitrary code execution. The exploit is operational and automates both reconnaissance (endpoint/context discovery) and exploitation phases. The README provides references to original research and related exploit code. The main fingerprintable endpoint is /api/jsonws (and /api/jsonws/invoke), which must be accessible for the exploit to succeed. The repository is well-structured, with a single main exploit script, a README, a license, and a .gitignore file.
This repository contains a working proof-of-concept exploit for CVE-2020-7961 (Liferay Portal JSONWS Java deserialization RCE, also known as LPS-97029). The main exploit logic is in 'poc.py', a Python script that automates the attack. The exploit works by: 1. Scanning the target Liferay Portal's JSONWS API (default path: /api/jsonws) for endpoints that accept Java objects. 2. Setting up a local HTTP server to serve a malicious Java class file ('LifExp.class'), which, when loaded, executes an OS command (e.g., launches calc.exe). 3. Sending a specially crafted serialized Java payload (using the C3P0WrapperConnPool gadget) to the vulnerable endpoint, instructing the target to fetch and deserialize the malicious class from the attacker's server. The repository includes: - 'poc.py': The main exploit script, which automates endpoint discovery, payload crafting, and exploitation. - 'LifExp.java': Example Java class to be compiled and served as the payload. This class executes an OS command when loaded. - 'README.md': Brief description and legal disclaimer. The exploit is operational and demonstrates unauthenticated remote code execution on vulnerable Liferay Portal instances. It requires the attacker to run a local HTTP server and have network access to the target's JSONWS API endpoint. The exploit is not part of a framework and is a standalone PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Liferay Portal Java unmarshalling via JSONWS remote code execution vulnerability used by EnemyBot.
A vulnerability affecting Liferay CE 6.2, mentioned as relevant to compromised servers hosting malicious payloads, but not the main subject of the article.
A Java unmarshalling remote code execution vulnerability via JSONWS in Liferay Portal, affecting versions prior to 7.2.1 CE GA2.
A deserialization of untrusted data vulnerability in Liferay Portal listed as one of the recent RCE vulnerabilities the botnet attempts to exploit.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.