Liferay Portal und Liferay DXP anfällig für CSRF in der Script Console

The impact of CVE-2024-8980 is severe due to the ability to execute arbitrary Groovy scripts. An attacker exploiting this vulnerability could gain unauthorized access to sensitive data, modify system configurations, or even execute arbitrary commands on the server. This could lead to data breaches, denial of service, or complete system takeover. The vulnerability's reliance on either a crafted URL or an existing XSS vulnerability expands the attack surface, making it potentially easier to exploit. Successful exploitation could allow attackers to impersonate legitimate users and perform actions on their behalf, further compounding the damage.

Organizations heavily reliant on Liferay Portal for their web applications and content management are at significant risk. This includes businesses using Liferay for customer portals, e-commerce platforms, or internal applications. Environments with legacy Liferay configurations or those lacking robust security practices are particularly vulnerable.

• linux / server: Monitor Liferay Portal logs for unusual script execution attempts or suspicious URLs containing script console references. Use journalctl -f to monitor for related errors.

journalctl -f | grep "Script Console" 

• generic web: Use curl to test for CSRF vulnerabilities by crafting malicious requests targeting the Script Console.

curl -X POST -d 'some_malicious_script' https://your-liferay-portal/scriptconsole 

• java: Review Liferay Portal's security configuration files for proper CSRF protection settings. Check for any disabled or misconfigured CSRF filters.

1. 2024-10-22Disclosure

   disclosure

2. 2024-10-22Patch

   patch

1. Reserviert2024-09-18
2. Veröffentlicht2024-10-22
3. Geändert2025-07-29
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-8980 is to upgrade to a patched version of Liferay Portal or DXP. Upgrade to Liferay Portal 7.4.3.102-GA102, Liferay DXP 2024.Q1.1, or a later version. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting access to the Script Console, implementing stricter CSRF protection mechanisms (e.g., using tokens), and carefully reviewing user permissions. Monitor Liferay logs for suspicious activity, particularly requests involving the Script Console. After upgrading, confirm the fix by attempting to execute a script via a crafted URL and verifying that the request is rejected.