CVE-2020-7961: Liferay Portal Deserialization of Untrusted Data Vulnerability

CVE-2020-7961 is a deserialization of untrusted data flaw in Liferay Portal that can let a remote attacker achieve code execution through JSON web services. For IT and security teams running Liferay as an intranet, extranet, or public portal platform, this class of issue matters because successful abuse can lead to full application compromise, lateral movement, and data exposure. Confirm exact product lines, fixed releases, and deployment notes against the vendor advisory before acting.

How it works

This vulnerability is tracked as CWE-502: deserialization of untrusted data. In broad terms, the application accepts serialized or structured input (here associated with JSON web services), reconstructs objects from that input, and does so without adequate validation or type restrictions. When an attacker can supply crafted data that the deserializer treats as trusted, the reconstruction process can trigger unexpected object graphs, gadget chains, or side effects that result in remote code execution in the context of the portal process.

Abuse typically requires the attacker to reach the affected JSON web service endpoints and submit malicious payloads. No public exploit mechanics, payload formats, or proof-of-concept details are restated here; treat any observed anomalous JSON service traffic as suspicious and validate behavior against the vendor advisory and your own baselined logs. The practical outcome of successful exploitation is arbitrary code execution on the host running Liferay Portal, with the privileges of the application server account.

Am I affected? How to find it in your systems

Liferay Portal is commonly deployed as a Java-based enterprise portal for content, collaboration, and custom portlets, often fronted by a web server or reverse proxy and backed by a database. Inventory every instance—production, staging, development, and any cloud or containerized deployments—by searching configuration management databases, software bills of materials, package inventories, and process lists for Liferay-related services and installation paths.

• Identify running Liferay Portal installations and record the exact version and patch level from the admin console, startup logs, or installation metadata; compare those versions only against the vendor advisory for CVE-2020-7961.
• Note whether JSON web services are enabled and reachable from untrusted networks; review service enablement settings and URL mappings that expose JSON endpoints.
• Check network exposure: internet-facing or partner-facing portals present higher risk than strictly internal instances behind strong authentication and network controls.
• Review application and access logs for unusual or high-volume requests to JSON web service paths, unexpected deserialization-related errors, sudden process spawning, or outbound connections initiated by the portal process after anomalous requests. Correlate with authentication failures or privilege changes if available.

If version or configuration detail is unclear, assume potential exposure until you confirm against the vendor advisory and your hardened baseline.

How to remediate

Patch first. Apply the updates provided by the vendor for Liferay Portal exactly as described in the official advisory for CVE-2020-7961. CISA’s required action is to apply updates per vendor instructions; do not rely on third-party version lists or unofficial backports without verification.

• Schedule and test the vendor update in a non-production environment that mirrors production configuration, including custom portlets and integrations.
• After patching, restart services as required, re-validate JSON web service behavior, and confirm the installed version matches a fixed release listed by the vendor.
• For this weakness class, harden deserialization paths going forward: disable unused JSON web services and remote invocation features, restrict which types can be deserialized if the platform supports allow-lists, and keep the application server and supporting libraries current.
• Enforce least privilege for the account running Liferay, separate the portal from sensitive data stores where feasible, and ensure administrative interfaces are not exposed to untrusted networks.

If you can't patch immediately

Until the vendor update is applied, reduce attack surface and increase detection depth.

• Segment Liferay hosts so that only required clients can reach JSON web service and administrative ports; block direct internet access if the business function allows.
• Use a web application firewall or reverse-proxy virtual patching rules tuned for anomalous or oversized payloads to JSON service endpoints, while recognizing that signature-only controls are imperfect for deserialization flaws.
• Disable or tightly restrict JSON web services and any related remote API features that are not strictly required.
• Increase monitoring: alert on unusual request patterns to service URLs, unexpected child processes or shell activity from the portal JVM, new persistence mechanisms, and unexpected outbound network connections. Retain logs for forensic review.
• Strengthen authentication and network access controls in front of the portal, and limit the privileges of the runtime account to contain potential code execution.

These steps lower risk but do not replace the vendor patch. Plan remediation promptly.

If your data may have been exposed

Actively exploited remote code execution vulnerabilities can lead to full host compromise and subsequent data theft or ransomware staging, even when ransomware use is not specifically documented for this CVE. If you have indicators of exploitation or cannot rule out exposure, follow your incident response process: isolate affected systems, preserve logs and memory where appropriate, rotate credentials and secrets accessible to the portal, and assess what data the application could reach. As an additional personal check, individuals can run a free exposure scan of their email addresses against known breach datasets to see whether their credentials have appeared in prior public breaches.