CVE-2024-26273 Overview
CVE-2024-26273 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the content page editor of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter handling. Remote attackers can trick authenticated administrators into executing forged requests through crafted links or pages. Successful exploitation allows attackers to change user passwords, shut down the server, execute arbitrary code in the scripting console, and perform other administrative actions. The vulnerability affects Liferay Portal 7.4.0 through 7.4.3.103 and multiple Liferay DXP releases.
Critical Impact
Attackers can hijack administrator sessions through forged requests to achieve arbitrary code execution via the scripting console, password resets, or full server shutdown.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.103
- Liferay DXP 2023.Q4.0 through 2023.Q4.2 and 2023.Q3.1 through 2023.Q3.5
- Liferay DXP 7.4 GA through update 92 and 7.3 update 29 through update 35
Discovery Timeline
- 2024-10-22 - CVE-2024-26273 published to NVD
- 2024-12-10 - Last updated in NVD database
Technical Details for CVE-2024-26273
Vulnerability Analysis
The vulnerability is a CSRF flaw [CWE-352] in the Liferay content page editor. The application fails to validate the authenticity of state-changing requests submitted through the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter. An attacker hosts a malicious page or sends a crafted link to an authenticated administrator. When the administrator visits the attacker-controlled content, the browser automatically submits the forged request using the victim's active session cookies. Because Liferay does not require a verifiable anti-CSRF token on the vulnerable endpoint, the server processes the request as if it originated from the legitimate administrator. The attack chains into the Liferay scripting console, enabling arbitrary Groovy or shell code execution under server privileges.
Root Cause
The root cause is missing or insufficient validation of CSRF tokens on the redirect parameter inside the CommerceCatalogsPortlet handler. Administrative endpoints can be invoked across origins without verifying request origin or a per-session token.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker lures an authenticated Liferay administrator to a malicious URL or webpage. The attack escalates from forged HTTP requests to arbitrary code execution through the scripting console, password manipulation, or server shutdown commands.
No verified public exploit code has been released for CVE-2024-26273. Refer to the Liferay Security Advisory CVE-2024-26273 for vendor technical details.
Detection Methods for CVE-2024-26273
Indicators of Compromise
- Unexpected HTTP POST requests containing _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameters with cross-origin Referer headers.
- Unauthorized password reset events or new privileged user accounts created shortly after an administrator visited an external site.
- Scripting console execution events (Groovy, Beanshell, Python) originating from administrator sessions outside of normal change windows.
- Unexpected shutdown actions or service restarts in Liferay server logs.
Detection Strategies
- Inspect web access logs for requests targeting CommerceCatalogsPortlet endpoints with external Referer or Origin headers.
- Correlate administrator session activity with browser-initiated requests to identify forged submissions.
- Alert on any invocation of the scripting console outside of approved maintenance procedures.
Monitoring Recommendations
- Forward Liferay audit logs and reverse-proxy access logs to a centralized SIEM for retention and correlation.
- Monitor for spikes in administrative actions such as password resets, role grants, and configuration changes.
- Track outbound network connections from the Liferay JVM that follow scripting console execution events.
How to Mitigate CVE-2024-26273
Immediate Actions Required
- Apply the Liferay security patch referenced in the vendor advisory for all affected Portal and DXP releases.
- Restrict administrative access to the Liferay control panel using network ACLs or VPN-only ingress.
- Require administrators to use isolated browser profiles or dedicated workstations when managing Liferay.
- Audit recent administrator activity for unauthorized password changes, scripting console executions, or shutdown events.
Patch Information
Liferay has published fixes through its security advisory portal. Upgrade Liferay Portal beyond 7.4.3.103 and Liferay DXP to a patched update beyond 7.4 update 92, 7.3 update 35, 2023.Q3.5, and 2023.Q4.2. Consult the Liferay Security Advisory CVE-2024-26273 for the specific fix pack matching your deployment.
Workarounds
- Disable the Liferay scripting console in production via portal properties to reduce post-exploitation impact.
- Enforce strict SameSite=Strict cookies on the Liferay session cookie to block cross-site request submission.
- Require administrators to log out of Liferay sessions when browsing untrusted sites.
- Deploy a web application firewall rule that drops requests to CommerceCatalogsPortlet endpoints lacking a valid p_auth token or with cross-origin referers.
# Configuration example - portal-ext.properties hardening
scripting.engine.groovy.enabled=false
session.cookie.same.site=Strict
auth.token.check.enabled=true
auth.token.ignore.actions=
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
