Liferay Portal ComboServletにおける、大きなファイルの組み合わせによるサービス拒否

The vulnerability allows an attacker to exhaust server resources by requesting the ComboServlet to combine a large number of files or files of significant size. This can lead to a complete denial of service, rendering the Liferay Portal instance unavailable to legitimate users. The impact extends beyond simple service disruption; prolonged DoS attacks can impact business operations, damage reputation, and potentially lead to financial losses. The ability to trigger this DoS remotely via a simple URL request makes it particularly concerning, as it requires minimal attacker effort and can be easily automated.

Organizations running Liferay Portal or Liferay DXP in production environments are at risk. Specifically, deployments using older, unsupported versions or those that have not applied recent updates are particularly vulnerable. Shared hosting environments where multiple tenants share the same Liferay instance may also be affected, as an attacker could potentially exploit the vulnerability to impact other tenants.

• linux / server: Monitor Liferay Portal logs for unusual activity related to the ComboServlet. Look for requests with extremely long URLs or large file sizes. Use journalctl -u liferay to filter for relevant log entries.

journalctl -u liferay | grep "ComboServlet" | grep -i "large file"

• generic web: Use curl to test the ComboServlet endpoint with a crafted URL containing a large number of files or a very large file. Monitor server resource usage (CPU, memory) during the test.

curl 'http://your-liferay-portal/alfresco/service/api/combo?client=portal&c=combo&comboType=file&file=file1.txt,file2.txt,file3.txt,...' -v

1. 2025-10-24Disclosure

   disclosure

1. 予約済み2025-10-09
2. 公開日2025-10-24
3. 更新日2025-11-15
4. EPSS 更新日2026-03-23

The primary mitigation is to upgrade to Liferay Portal version 97.0.0 or later, which includes the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include rate limiting requests to the ComboServlet, restricting the maximum size of combined files, or implementing a Web Application Firewall (WAF) rule to block requests with excessively long query strings. Monitor server resource utilization closely for any signs of unusual activity. After upgrading, confirm the fix by attempting to trigger the vulnerability with a crafted URL and verifying that the server does not experience a denial of service.