Two vulnerabilities have been reported in Liferay Portal, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to compromise a vulnerable system.

1) An error within the "updateOrganizations" method in the UserServiceUtil class can be exploited to add a user to an arbitrary organisation.

2) An error in the IP filter when handling forward targets can be exploited to bypass the filter and gain unauthorised access to certain webservices.

This can further be exploited to compromise a vulnerable system via e.g. specially crafted requests to the "tunnel" webservice.

The vulnerabilities are reported in versions 6.1 CE and prior and 6.1 EE and prior.

Solution
Reportedly fixed in versions 6.1 GA1 CE and 6.1 GA1 EE.

Provided and/or discovered by
Jelmer Kuperus

Original Advisory
http://packetstormsecurity.org/files/112677/Liferay-Portal-Privilege-Escalation.html
http://packetstormsecurity.org/files/112735/Liferay-6.1-No-Account-Access-Bypass.html

Deep Links
Links available to Secunia VIM customers