Disable Gogo Shell Telnet Access To Prevent Wide Range Of Vulnerabilities

• Type: Story
• Status: Closed
• Priority: Major
• Resolution: Completed
• Affects Version/s: Master
• Fix Version/s: 7.1.0 CE GA1, 7.1.10 DXP FP1, Master
• Component/s: Application Security
• Labels:
  • 7.1-must
  • liferay-fixpack-dxp-1-7110
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/60730

With Gogo Shell Portlet now available in portal 7.1 we should disable telnet access as a security precaution.

With telnet listening on localhost:11311 any potential XXE or SSRF vulnerability or other local application can compromise portal installation.

 

The telnet access will still be available for components that depends on it (portal upgrade) and for developers in portal-developer.properties