为什么值得关注

展示了严谨的多代理（25 个生成器、22 个评判器、9 个验证器）漏洞发现方法论，通过独立代码反证和真实 Docker 实例的实时验证，不仅复现了已知严重 RCE，还发现了已停产品中的多个新缺陷，并提供详细证据和即用验证脚本。

适合谁使用

关注 Java Web 应用的安全研究人员和渗透测试人员
负责遗留 Liferay 部署的管理员
评估未修补 Liferay 版本风险的 DevSecOps 团队
需要真实漏洞案例研究的 CTF 或教育实验室

典型使用场景

对遗留 Liferay 安装进行漏洞评估
学习反序列化、SSRF、IDOR 和模板注入攻击模式
验证 Liferay 7.0.x 的安全控制与加固措施
使用提供的 Python 检测脚本构建自动化安全测试管道

项目优势

包含确定性重建、独立评判反证和实时验证的多阶段方法论
所有发现均有详细证据文件支持（捕获的请求/响应、代码追踪）
包含一个即用的纯 Python 验证脚本，覆盖所有实时验证的发现
通过提供的 Dockerfile 和逐步设置说明实现可重现环境

使用前须知

审计针对已停止维护的产品（Liferay CE 7.0.3 GA4），无补丁支持，发现未提交 CVE 分配
部分漏洞需要非默认配置（如 OpenID、token SSO、OpenSocial/WSRP 模块），未进行实时测试
覆盖范围为组件导向，未进行完整源码树分析（仅使用 Semgrep 锚点），可能存在其他漏洞

README 快速开始

Liferay CE 7.0.3 GA4 — Vulnerability Research (RAPTOR Loop-Hunt)

A security audit of Liferay Portal CE 7.0.3 GA4 (git tag 7.0.3-ga4, commit b2d7cc68a) performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents refuting from raw → 9 live validators attacking a real GA4 instance in Docker.

Headline: unauthenticated RCE as root reproduced end-to-end (CVE-2020-7961 class), plus 8 more live-verified vulnerabilities — several of them with no known CVE.

⚠️ Legal/ethical: everything here targets a self-hosted test instance. Liferay CE 7.0 is end-of-life (last release 7.0.6 GA7, 2018); these issues are unpatched upstream. Use this material only against systems you own or are explicitly authorized to test.

You are probably looking for https://github.com/dinosn/liferay-ga4-rce-research/blob/main/tools/liferay_ga4_check.py :)

Findings at a glance

Status: ✅ live-verified against the Docker GA4 instance · 🔬 confirmed-by-code (independent judge re-derived the full trace from raw source) · 🧪 needs/config-gated.

ID	Finding	Severity	Auth	Status	Evidence
F-1	JSONWS type-override → arbitrary class instantiation + setters → RCE as root (c3p0 `HexAsciiSerializedMap` → `ObjectInputStream` → AspectJWeaver file-write → JSP)	Critical	none	✅	verified/f1-jsonws-deser-rce.md
F-2	`/poller/` jabsorb `javaClass` hint → arbitrary class instantiation + field injection, before* userId validation	High (potential)	any account (self-registration default-on)	✅ sink / RCE arm open	verified/F-2-poller.md
F-4	XML-RPC `pingback.ping` fetch-before-validate → blind SSRF + internal port oracle (reached Gogo shell on `127.0.0.1:11311`)	Medium	none	✅	verified/f4-xmlrpc-pingback-ssrf.md
F-5	`SyncDownloadServlet` `versionId` IDOR → read any DL file version (cross-site, no VIEW check on the streamed object)	High	none (via guest-viewable "leg")	✅	verified/F-5.md
F-6	XSL template engine ignores sandboxing (`secureProcessing=false`, `restricted` dropped) → `docume

项目描述

Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.

liferay-ga4-rce-research