PT-2022-19337 · Liferay · Liferay Portal+1

Published 2022-09-22 · Updated 2024-12-11 · CVE-2022-28977

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.1 through 7.4.2 Liferay DXP versions 7.0 fix pack 91 through 101 Liferay DXP versions 7.1 fix pack 17 through 25 Liferay DXP versions 7.2 fix pack 5 through 14 Liferay DXP version 7.3 before service pack 3

Description The issue allows remote attackers to redirect users to arbitrary external URLs by circumventing HtmlUtil.escapeRedirect using multiple forward slashes. This can be achieved via the redirect parameter, FORWARD URL parameter, and other parameters that rely on HtmlUtil.escapeRedirect.

Recommendations For Liferay Portal versions 7.3.1 through 7.4.2, update to a version that includes the fix for this issue. For Liferay DXP versions 7.0 fix pack 91 through 101, apply a fix pack that addresses this vulnerability. For Liferay DXP versions 7.1 fix pack 17 through 25, apply a fix pack that addresses this vulnerability. For Liferay DXP versions 7.2 fix pack 5 through 14, apply a fix pack that addresses this vulnerability. For Liferay DXP version 7.3 before service pack 3, apply service pack 3 or later to resolve the issue. As a temporary workaround, consider restricting access to parameters that rely on HtmlUtil.escapeRedirect, such as redirect and FORWARD URL, to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-28977

GHSA-W397-9P2J-6X23

Affected Products

Liferay Dxp

Liferay Portal

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2022-28977 · Security Note
• https://osv.dev/vulnerability/GHSA-w397-9p2j-6x23 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28977 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b · Note
• https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8 · Note
• https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48 · Note
• https://liferay.atlassian.net/browse/LPE-17327 · Note
• https://t.me/cvenotify/71958 · Telegram Post
• https://t.me/cvenotify/103894 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cibsecurity/50250 · Telegram Post
• https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash · Note
• http://liferay.com · Note