PT-2024-21038 · Liferay · Liferay Portal+1

Published 2024-02-20 · Updated 2024-12-11 · CVE-2024-25609

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.3.12 Liferay DXP 7.4 before update 9 Liferay DXP 7.3 service pack 3 Liferay DXP 7.2 fix pack 15 through 18

Description The issue allows remote attackers to redirect users to arbitrary external URLs via certain parameters, including the redirect parameter and FORWARD URL parameter, by circumventing the HtmlUtil.escapeRedirect function using two forward slashes. This is a result of an incomplete fix.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.3.12, update to a version that includes the complete fix for this issue. For Liferay DXP 7.4, apply update 9 or later. For Liferay DXP 7.3, apply service pack 3 or later. For Liferay DXP 7.2, apply fix pack 19 or later, as fix packs 15 through 18 are affected. As a temporary workaround, consider restricting the use of the redirect parameter and FORWARD URL parameter until a patch is available.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-25609

GHSA-3QQ5-WCRX-4H8R

Affected Products

Liferay Dxp

Liferay Portal

References · 16

• https://osv.dev/vulnerability/CVE-2024-25609 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25609 · Security Note
• https://osv.dev/vulnerability/GHSA-3qq5-wcrx-4h8r · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886 · Note
• https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d · Note
• https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed · Note
• https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003 · Note
• https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362 · Note
• https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0 · Note
• https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a · Note
• https://twitter.com/dailycve/status/1866929012624289928 · Twitter Post
• https://t.me/cvenotify/71958 · Telegram Post
• https://t.me/cvenotify/103894 · Telegram Post