Liferay Portal JSONWS Untrusted Data Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-7961)
Executive & SecOps Summary
SECOPS ASSESSMENTLiferay Portal versions prior to 7.2.1 CE GA2
Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting the JSON web services (JSONWS) API to deserialize untrusted Java objects
Immediately upgrade Liferay Portal to version 7.2.1 CE GA2 or later, and restrict external access to the JSONWS API endpoints
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Liferay Portal instance to version 7.2.1 CE GA2 or later.
# For Docker-based deployments, pull the patched Liferay Portal image
docker pull liferay/portal:7.2.1-ga2
# Stop the vulnerable container and run the updated version
docker stop liferay-container
docker run -d --name liferay-patched -p 8080:8080 liferay/portal:7.2.1-ga22. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, block external access to the JSONWS endpoints using a reverse proxy like Nginx or a Web Application Firewall (WAF).
# Add the following block to your Nginx configuration (/etc/nginx/nginx.conf)
server {
listen 80;
server_name liferay.example.com;
# Block external access to JSONWS endpoints
location ~* ^/api/(jsonws|secure/jsonws) {
deny all;
return 403;
}
location / {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Use the following commands to inspect Liferay access logs for potential exploitation attempts targeting the JSONWS API.
# Search for suspicious POST requests to the JSONWS endpoints
echo '[*] Scanning logs for JSONWS API access...'
grep -Ei 'POST.*/api/jsonws' /var/log/liferay/*.log || echo 'No suspicious JSONWS POST requests detected.'
# Search for common deserialization gadget class names in the logs
echo '[*] Scanning logs for potential gadget class patterns...'
egrep -i '(org.apache.commons|spring|jackson|jodd)' /var/log/liferay/*.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical deserialization of untrusted data (CWE-502) vulnerability located in the JSON Web Services (JSONWS) API endpoint of Liferay Portal. Liferay Portal utilizes Flexjson and custom deserialization mechanisms to bind incoming JSON parameters to Java objects. Due to a lack of robust class-type validation (safelisting) during this binding process, an unauthenticated attacker can force the application to instantiate arbitrary classes available on the classpath.
2. Exploitation Mechanics & Attack Scenario
An attacker can access the /api/jsonws endpoint without authentication. The exploitation flow is as follows:
- The attacker crafts a malicious HTTP POST request targeting a JSONWS service method.
- By manipulating the parameter type definition in the request, the attacker specifies a vulnerable gadget class (such as those found in Apache Commons Collections or Spring libraries).
- When Liferay attempts to deserialize the incoming JSON payload into the specified class, the gadget chain is triggered, leading to arbitrary OS command execution under the context of the JVM process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk. It is listed in the CISA KEV catalog and has been actively exploited in the wild by botnets (e.g., FreakOut) and threat actors to deploy malware and ransomware. Successful exploitation grants full control over the hosting server, potentially leading to lateral movement, database compromise, and severe business disruption.
Official Vendor Advisories & References
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Frequently Asked SecOps Questions (CVE-2020-7961)
FAQQ1. How critical is CVE-2020-7961 and is it actively exploited in the wild?
CVE-2020-7961 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-7961?
Primary impacted vendors include liferay across liferay_portal. Scope summary: All Liferay Portal versions prior to 7.2.1 CE GA2 (including 7.0, 7.1, and 7.2 branches)
Q3. What temporary mitigations or workarounds exist for CVE-2020-7961 before patching?
[Mitigation] Immediately upgrade Liferay Portal to version 7.2.1 CE GA2 or later, and restrict external access to the JSONWS API endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-7961
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (liferay)
View Category →JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.