CVE-2024-26272 Overview
CVE-2024-26272 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the content page editor of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in handling of the p_l_back_url parameter, which allows remote attackers to trick authenticated users into performing unintended administrative actions. Successful exploitation lets an attacker change user passwords, shut down the server, execute arbitrary code through the scripting console, and perform other privileged operations. The issue affects Liferay Portal 7.3.2 through 7.4.3.107 and multiple Liferay DXP release lines.
Critical Impact
An attacker who convinces an authenticated administrator to visit a crafted URL can achieve arbitrary code execution through the scripting console and full compromise of the Liferay instance.
Affected Products
- Liferay Portal 7.3.2 through 7.4.3.107
- Liferay DXP 2023.Q4.0 through 2023.Q4.2 and 2023.Q3.1 through 2023.Q3.5
- Liferay DXP 7.4 GA through update 92 and 7.3 GA through update 35
Discovery Timeline
- 2024-10-22 - CVE-2024-26272 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-26272
Vulnerability Analysis
The content page editor in Liferay Portal and DXP fails to enforce anti-CSRF protections on state-changing requests that use the p_l_back_url parameter. Because the editor does not validate that a request originated from a legitimate, same-origin form submission, an attacker can craft a URL or HTML page that, when loaded by an authenticated administrator, causes the browser to submit an authenticated request to the Liferay instance.
The editor exposes powerful administrative functions, including user management and access to the scripting console. When these functions are invoked via the vulnerable code path, they honor the victim's session and execute with the victim's privileges. This turns a routine authenticated browsing action into a full administrative operation.
Root Cause
The root cause is missing or insufficient CSRF token validation on requests that consume the p_l_back_url parameter within the content page editor. The application trusts the presence of a valid session cookie and the format of the request instead of requiring a unique per-session anti-forgery token bound to the request body.
Attack Vector
Exploitation requires user interaction. An attacker hosts a crafted page containing an auto-submitting form or an image tag that triggers a request to the vulnerable Liferay endpoint. When an authenticated administrator visits the page, the browser attaches session cookies and issues the request. The server processes the action as though the administrator had initiated it. Depending on the target endpoint invoked through p_l_back_url, the attacker can reset credentials, execute Groovy or similar scripts through the scripting console, or shut down the server.
See the Liferay Security Advisory CVE-2024-26272 for vendor-published technical details.
Detection Methods for CVE-2024-26272
Indicators of Compromise
- Unexpected HTTP requests to the content page editor that include a p_l_back_url parameter pointing to an unusual or external URL.
- Password reset events, scripting console executions, or server shutdown actions correlated with an administrator's session but originating from a Referer header outside the Liferay domain.
- New or modified administrative accounts created shortly after an administrator loaded an external link.
Detection Strategies
- Inspect Liferay access logs for requests containing p_l_back_url values that decode to external hosts or unexpected internal paths.
- Correlate administrator session activity with browser Referer and Origin headers to surface cross-site initiated requests.
- Alert on any invocation of the Liferay scripting console that is not preceded by an interactive navigation sequence within the admin UI.
Monitoring Recommendations
- Enable verbose auditing for privileged actions such as password changes, script execution, and server lifecycle operations.
- Forward Liferay application and web server logs to a centralized analytics platform to enable cross-source correlation.
- Monitor for spikes in 4xx/5xx responses on content page editor endpoints, which can indicate exploitation attempts.
How to Mitigate CVE-2024-26272
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release above 7.4.3.107 and apply the latest updates for the 7.3 and 7.4 branches.
- For Liferay DXP, apply the fix for the affected quarterly releases (2023.Q3, 2023.Q4) and move 7.4 installations beyond update 92 and 7.3 installations beyond update 35.
- Rotate administrator credentials and audit user accounts, scheduled scripts, and recent server events after patching.
Patch Information
Liferay has published fixes for this vulnerability. Refer to the Liferay Security Advisory CVE-2024-26272 for the specific fix versions applicable to each supported release line.
Workarounds
- Restrict access to the Liferay administrative interface to trusted networks or VPN-only ranges to reduce exposure to browser-driven CSRF attacks.
- Instruct administrators to use a dedicated browser profile for Liferay administration and to avoid browsing untrusted content while authenticated.
- Deploy a web application firewall rule that blocks requests to content page editor endpoints when Origin or Referer headers are missing or point outside the Liferay domain.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
