PUBLIC - Liferay Portal Community Edition
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-26596

Potential memory leak and security vulnerability through CacheFilter and WebServerServlet

    Details

    • Branch Version/s:
      6.1.x
    • Backported to Branch:
      Committed
    • Similar Issues:
      Show 4 results 

      Description

      Currently for search engine optimization (and possibly to be immune to those values changing), when there are four parts to the path in WebServerServlet the middle two sections are ignored and only the groupId and the uuid_ are used to return the image.

      While this is not problematic in of itself, if a user uploads any file to the Documents and Media portlet and crafts 10,000 versions of the /image/groupId/gibberish/gibberish/uuid URL with different values of gibberish each time, they can fill up the CacheUtil cache (by default 10,000 elements) with items up to cache.content.threshold.size (default 512,000 bytes).

      With default configuration settings for cache and max image size, a malicious user can fill up 5 GB of heap by requesting a 512,000 byte image 10,000 times with different values for the middle two components of the path each time. For most Liferay installations, this is sufficient to crash the server with an OutOfMemoryException for thirty minutes (the time it takes for the cache entries to expire).

        Activity

        Hide
        Michael Saechang added a comment - - edited

        Committed on:
        Portal 6.1.x GIT ID: edc130a6ca419ec6aefb7a6fff6e34ff2864a987.
        Portal 6.2.x GIT ID: fc10d81c69b3f564d67f43112b4fd7959fc6c25c.

        Show
        Michael Saechang added a comment - - edited Committed on: Portal 6.1.x GIT ID: edc130a6ca419ec6aefb7a6fff6e34ff2864a987. Portal 6.2.x GIT ID: fc10d81c69b3f564d67f43112b4fd7959fc6c25c.

          People

          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:
              Days since last comment:
              3 years, 11 weeks, 4 days ago

              Development

                Structure Helper Panel