CVE-2024-26267: Liferay Portal Information Disclosure Flaw

CVE-2024-26267 Overview

CVE-2024-26267 is an information disclosure vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The default value of the portal property http.header.version.verbosity is set to full, causing the server to advertise its exact version through the Liferay-Portal HTTP response header. Remote attackers can query any exposed endpoint and immediately learn the running version. Attackers then correlate that version with public vulnerability databases to select working exploits. The issue affects Liferay Portal 7.2.0 through 7.4.3.25 and multiple older DXP releases.

Critical Impact
Unauthenticated attackers can fingerprint Liferay deployments over the network without triggering authentication controls, accelerating targeted exploitation of unpatched instances.

Affected Products

Liferay Portal 7.2.0 through 7.4.3.25 (and older unsupported versions)
Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19
Liferay DXP older unsupported versions

Discovery Timeline

2024-02-20 - CVE-2024-26267 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26267

Vulnerability Analysis

CVE-2024-26267 is an Information Exposure issue tracked under [CWE-1188: Insecure Default Initialization of Resource]. Liferay ships with the portal property http.header.version.verbosity set to full. With this default, every HTTP response returned by the portal includes a Liferay-Portal header that lists the precise product name, version, and build identifiers.

The vulnerability does not grant code execution or data modification. Instead, it lowers the reconnaissance cost for attackers. Once the version is known, adversaries can map the instance to disclosed vulnerabilities affecting that exact release and prepare tailored payloads. Automated scanners routinely parse the Liferay-Portal header to catalog exposed instances at internet scale.

Root Cause

The root cause is an insecure default configuration. The http.header.version.verbosity property should default to a restrictive value (such as partial or none) but is instead set to full. Administrators unaware of the property inherit the verbose disclosure without any explicit action.

Attack Vector

Exploitation is trivial and unauthenticated. An attacker sends any HTTP request to the Liferay instance, including GET / or a request to /c/portal/login, and inspects the response headers. The Liferay-Portal header is returned in every response regardless of the requested resource or the authentication state. No user interaction, privileges, or complex conditions are required. The disclosed version string is then used to select public exploits, such as those targeting historic Liferay RCE and deserialization flaws.

Detection Methods for CVE-2024-26267

Indicators of Compromise

Repeated HTTP HEAD or GET requests to portal endpoints from a single source, correlated with subsequent exploitation attempts against known Liferay CVEs.
External reconnaissance tools (for example, Shodan, Censys, or nuclei) fingerprinting the Liferay-Portal response header value.
Web server logs containing minimal-request scans against /c/portal/login, /api/jsonws, or the site root followed by targeted payloads.

Detection Strategies

Inspect outbound HTTP responses from Liferay web tiers for the presence of a populated Liferay-Portal header disclosing a version.
Query web proxy or WAF telemetry for scanners that read response headers without completing an authentication flow.
Correlate version fingerprinting events with follow-on requests to Liferay endpoints historically associated with CVEs.

Monitoring Recommendations

Alert when internet-facing Liferay instances return the Liferay-Portal header with any non-empty value.
Track reconnaissance patterns in SIEM by grouping source IPs that request only headers or root paths across multiple hosts.
Monitor Liferay access logs for User-Agent strings associated with vulnerability scanners.

How to Mitigate CVE-2024-26267

Immediate Actions Required

Upgrade Liferay DXP to 7.4 update 26, 7.3 update 5, 7.2 fix pack 19, or later per the Liferay security advisory.
Upgrade Liferay Portal Community Edition beyond 7.4.3.25 to a release where the property default is hardened.
Set http.header.version.verbosity explicitly to partial or none in portal-ext.properties on all environments.

Patch Information

Liferay addressed the vulnerability by changing the default value of http.header.version.verbosity. Apply the vendor-supplied updates listed in the Liferay CVE-2024-26267 Vulnerability advisory. After upgrading, verify the effective configuration by inspecting response headers from a non-admin host.

Workarounds

Override the property in portal-ext.properties with http.header.version.verbosity=none and restart the portal.
Configure the upstream reverse proxy (for example, Apache HTTP Server, NGINX, or a WAF) to strip the Liferay-Portal response header before responses leave the perimeter.
Restrict administrative and management endpoints to trusted networks to reduce the value of version fingerprinting.

bash

# Configuration example: portal-ext.properties
http.header.version.verbosity=none

# NGINX header stripping example
# proxy_hide_header Liferay-Portal;