CVE-2024-26271: Liferay DXP CSRF Vulnerability

CVE-2024-26271 Overview

CVE-2024-26271 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the My Account widget of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw exists in the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter. Remote attackers can trick authenticated users — particularly administrators — into submitting forged requests that change user passwords, shut down the server, execute arbitrary code through the scripting console, or perform other administrative actions. The vulnerability affects Liferay Portal 7.4.3.75 through 7.4.3.111 and multiple Liferay DXP release lines including 2023.Q4, 2023.Q3, 7.4, and 7.3 updates.

Critical Impact

Successful exploitation allows remote attackers to perform privileged administrative operations, including arbitrary code execution via the scripting console, by abusing an authenticated administrator's session.

Affected Products

• Liferay Portal 7.4.3.75 through 7.4.3.111
• Liferay DXP 2023.Q4.0 through 2023.Q4.2 and 2023.Q3.1 through 2023.Q3.5
• Liferay DXP 7.4 update 75 through 92, and 7.3 update 32 through 36

Discovery Timeline

• 2024-10-22 - CVE-2024-26271 published to NVD
• 2024-12-10 - Last updated in NVD database

Technical Details for CVE-2024-26271

Vulnerability Analysis

The My Account portlet in Liferay accepts a backURL parameter intended to redirect users after profile actions. The portlet does not enforce anti-CSRF token validation on state-changing requests routed through this parameter. An attacker hosts a malicious page that submits a forged request to a vulnerable Liferay instance. When an authenticated administrator visits the page, the browser automatically attaches session cookies, and the request executes with the administrator's privileges.

Because the My Account portlet is reachable by any authenticated user and exposes paths into administrative functionality, the abuse surface includes password changes, server shutdown, and access to the Groovy scripting console. The scripting console executes arbitrary server-side code, turning the CSRF into a path to remote code execution under the application server's context.

Root Cause

The root cause is missing or insufficient CSRF protection [CWE-352] on requests handled through the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter. State-changing actions do not validate an unpredictable per-session token, so the application cannot distinguish forged cross-origin requests from legitimate ones.

Attack Vector

Exploitation requires user interaction. An attacker crafts a page or email containing an auto-submitting HTML form or image tag pointing at the vulnerable Liferay endpoint with attacker-controlled parameters. A logged-in Liferay administrator who loads the attacker content unknowingly triggers the request. The crafted request reaches the My Account portlet, which processes it with the victim's privileges and performs the targeted administrative action. No credentials are needed by the attacker beyond convincing a privileged user to load the malicious content.

No public proof-of-concept code is referenced in the advisory. See the Liferay CVE-2024-26271 Advisory for vendor technical details.

Detection Methods for CVE-2024-26271

Indicators of Compromise

• HTTP requests to MyAccountPortlet endpoints containing the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter with external Referer or Origin headers.
• Unexpected password change events or new administrative actions correlated with administrator browsing sessions outside normal workflows.
• Scripting console executions or server shutdown events that do not correlate with planned operational activity.

Detection Strategies

• Inspect Liferay access logs for POST requests to My Account portlet URLs with cross-origin Referer values or missing CSRF token parameters.
• Alert on Groovy or scripting console invocations originating from session contexts that have not previously used those features.
• Correlate password reset events, account modifications, and server lifecycle commands against the source IP and user-agent of the initiating session.

Monitoring Recommendations

• Forward Liferay application logs, web server logs, and audit logs to a centralized analytics platform for retention and query.
• Baseline administrator activity and flag deviations such as scripting console use, shutdown invocations, or bulk account changes.
• Monitor outbound proxy and email gateway logs for users visiting suspicious URLs immediately preceding administrative changes in Liferay.

How to Mitigate CVE-2024-26271

Immediate Actions Required

• Upgrade Liferay Portal and DXP to a fixed release as published in the Liferay security advisory.
• Restrict administrator access to Liferay from dedicated workstations and networks to reduce CSRF exposure from general-purpose browsing.
• Audit recent password changes, scripting console activity, and server lifecycle events for signs of abuse.

Patch Information

Liferay has published fixed versions and remediation guidance for CVE-2024-26271. Customers running affected Liferay Portal 7.4.3.75–7.4.3.111 and Liferay DXP 2023.Q4, 2023.Q3, 7.4, and 7.3 release lines should apply the updates referenced in the vendor advisory. Refer to the Liferay CVE-2024-26271 Advisory for the exact target versions and upgrade procedure.

Workarounds

• Require administrators to use separate browser profiles or dedicated browsers for Liferay administration to limit cross-site request exposure.
• Configure the reverse proxy or web application firewall to reject requests to MyAccountPortlet endpoints that lack a same-origin Referer or Origin header.
• Disable or restrict access to the scripting console and server shutdown actions for non-essential administrative accounts until patching is complete.

# Example WAF rule concept (ModSecurity-style) to block cross-origin POSTs to MyAccountPortlet
SecRule REQUEST_URI "@contains _com_liferay_my_account_web_portlet_MyAccountPortlet" \
    "chain,phase:2,deny,status:403,id:1002601,msg:'Possible CSRF against Liferay My Account portlet'"
    SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://liferay.example.com"