A systematic security audit of the end-of-life Liferay Portal CE 7.0.3 GA4 using the RAPTOR loop-hunt methodology, uncovering 9 live-verified vulnerabilities including unauthenticated remote code execution (CVE-2020-7961), several new CVEs, and providing reproducible Docker setup and validation scripts.
5
No data
1
0
No data
2026-07-28
Demonstrates a rigorous, multi-agent (25 generators, 22 judges, 9 validators) methodology for vulnerability discovery, with independent code-based refutation and live verification against a real Docker instance. It not only reproduces a known critical RCE but also uncovers multiple previously unknown flaws in an EOL product, providing detailed evidence and a ready-to-use validation script.
A security audit of Liferay Portal CE 7.0.3 GA4 (git tag 7.0.3-ga4, commit
b2d7cc68a) performed with the RAPTOR loop-hunt methodology:
deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge
agents refuting from raw → 9 live validators attacking a real GA4 instance in Docker.
Headline: unauthenticated RCE as
rootreproduced end-to-end (CVE-2020-7961 class), plus 8 more live-verified vulnerabilities — several of them with no known CVE.
⚠️ Legal/ethical: everything here targets a self-hosted test instance. Liferay CE 7.0 is end-of-life (last release 7.0.6 GA7, 2018); these issues are unpatched upstream. Use this material only against systems you own or are explicitly authorized to test.
Status: ✅ live-verified against the Docker GA4 instance · 🔬 confirmed-by-code (independent judge re-derived the full trace from raw source) · 🧪 needs/config-gated.
| ID | Finding | Severity | Auth | Status | Evidence |
|---|---|---|---|---|---|
| F-1 | JSONWS type-override → arbitrary class instantiation + setters → RCE as root (c3p0 HexAsciiSerializedMap → ObjectInputStream → AspectJWeaver file-write → JSP) | Critical | none | ✅ | verified/f1-jsonws-deser-rce.md |
| F-2 | /poller/* jabsorb javaClass hint → arbitrary class instantiation + field injection, before userId validation | High (potential) | any account (self-registration default-on) | ✅ sink / RCE arm open | verified/F-2-poller.md |
| F-4 | XML-RPC pingback.ping fetch-before-validate → blind SSRF + internal port oracle (reached Gogo shell on 127.0.0.1:11311) | Medium | none | ✅ | verified/f4-xmlrpc-pingback-ssrf.md |
| F-5 | SyncDownloadServlet versionId IDOR → read any DL file version (cross-site, no VIEW check on the streamed object) | High | none (via guest-viewable "leg") | ✅ | verified/F-5.md |
| F-6 | XSL template engine ignores sandboxing (secureProcessing=false, restricted dropped) → `docume |
Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.
Similar projects matched by category, topics, and programming language.
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
Kimi K3 is an open-weight, 2.8T-parameter native multimodal agentic model with a 1M-token context window, designed for frontier coding, knowledge work, and reasoning tasks.
A browser-based first-person shooter built entirely with procedural generation and orchestrated AI agents, featuring 55k lines of Three.js/WebGL2 code and no art assets.