GHSA-ghw5-998m-vw4w

Liferay Portal and Liferay DXP fails to check origin of event messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25146

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.remote.app.web	< 2.0.21	2.0.21
Maven	com.liferay.portal:release.dxp.bom	< 7.4.13.u5	7.4.13.u5

Details

As written in the advisory (Markdown source, shown as plain text).

The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25146 advisory
https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b web
https://github.com/liferay/liferay-portal package
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-a… web
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltratio… web
http://liferay.com web