CVE-2024-38002: Liferay DXP RCE Vulnerability

CVE-2024-38002 Overview

CVE-2024-38002 is an authorization bypass vulnerability in the workflow component of Liferay Portal and Liferay DXP. The workflow component fails to properly check user permissions before updating a workflow definition. Remote authenticated users can modify workflow definitions through the headless API and achieve arbitrary code execution on the server. The flaw is tracked under CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). Affected versions include Liferay Portal 7.3.2 through 7.4.3.111 and multiple Liferay DXP release lines. Successful exploitation grants full compromise of confidentiality, integrity, and availability on the target Liferay instance.

Critical Impact
An authenticated user with low privileges can modify workflow definitions via the headless API and execute arbitrary code on the Liferay server, resulting in full portal compromise.

Affected Products

Liferay Portal 7.3.2 through 7.4.3.111
Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
Liferay DXP 7.4 GA through update 92, and 7.3 GA through update 36

Discovery Timeline

2024-10-22 - CVE-2024-38002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38002

Vulnerability Analysis

The vulnerability resides in the workflow subsystem of Liferay Portal and Liferay DXP. Liferay workflows are defined using Kaleo XML definitions that describe states, transitions, and scripted actions. Scripted actions can be written in Groovy, JavaScript, or other JVM-supported languages, and they execute inside the Liferay server process. The workflow component exposes management operations through Liferay's headless (REST) API. The endpoint that updates workflow definitions does not enforce the required administrative permission check before applying changes. As a result, any authenticated portal user can supply a modified Kaleo definition containing attacker-controlled scripts. When the associated workflow instance is triggered, the embedded script runs with the privileges of the Liferay JVM, yielding remote code execution.

Root Cause

The root cause is missing or incorrect authorization enforcement on the workflow definition update path exposed by the headless API. The action should be restricted to users holding workflow administration permissions, but the check is either absent or evaluated incorrectly, matching the [CWE-862] and [CWE-863] classification. Because Kaleo workflow definitions permit scripted actions that run server-side, the authorization gap escalates directly into arbitrary code execution.

Attack Vector

Exploitation is network-based and requires a valid low-privilege account on the Liferay instance. An attacker authenticates to the portal, issues a headless API request to update an existing workflow definition, and injects a scripted action containing arbitrary Java or Groovy code. Triggering the workflow — either by initiating a workflow-enabled asset submission or by relying on scheduled/system-driven transitions — causes the injected script to execute in the Liferay JVM. From that foothold, an attacker can read configuration files, extract database credentials, deploy webshells, or pivot into the internal network.

No public proof-of-concept exploit has been listed in ExploitDB, and the CVE is not currently on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.611% (percentile 46.058) as of 2026-08-11. See the Liferay Security Advisory CVE-2024-38002 for vendor guidance.

Detection Methods for CVE-2024-38002

Indicators of Compromise

Unexpected PUT or POST requests to Liferay headless workflow endpoints such as /o/headless-admin-workflow/v1.0/workflow-definitions originating from non-administrative accounts.
New or modified Kaleo workflow definitions containing <script> elements referencing Runtime, ProcessBuilder, Groovy, or shell invocation primitives.
Child processes spawned by the Liferay/Tomcat JVM (for example, sh, bash, cmd.exe, powershell.exe) shortly after workflow-related API traffic.
Outbound network connections from the Liferay host to unfamiliar destinations following workflow definition changes.

Detection Strategies

Alert on modifications to workflow definitions performed by accounts that do not hold workflow administration roles.
Inspect request bodies to workflow definition endpoints for embedded scripting languages and suspicious API calls in Kaleo <script> blocks.
Correlate application-server access logs with process execution telemetry on the host to catch script-driven code execution.

Monitoring Recommendations

Enable and forward Liferay audit logs, application server access logs, and JVM process telemetry to a centralized analytics platform.
Baseline normal workflow definition change frequency and authors, then alert on deviations.
Monitor for post-exploitation behaviors such as credential access to portal-ext.properties and outbound egress from the Liferay tier.

How to Mitigate CVE-2024-38002

Immediate Actions Required

Apply the fixed Liferay Portal and Liferay DXP releases identified in the Liferay Security Advisory CVE-2024-38002.
Audit accounts that have accessed workflow headless endpoints and rotate credentials for any user or service account showing anomalous activity.
Review all custom and stock workflow definitions for unauthorized <script> elements and revert or remove suspicious content.

Patch Information

Liferay has published fixes for the affected release lines. Upgrade Liferay Portal beyond 7.4.3.111 and update Liferay DXP to versions past 7.4 update 92, 7.3 update 36, 2023.Q3.8, and 2023.Q4.5. Refer to the vendor advisory for the exact target versions and quarterly release fixes applicable to your deployment.

Workarounds

Restrict network access to the Liferay headless API so it is reachable only from trusted management networks.
Enforce least privilege on portal roles and remove workflow-related capabilities from users who do not require them.
Require multi-factor authentication for all portal accounts to raise the barrier for the authenticated precondition.
Deploy a web application firewall rule that inspects requests to /o/headless-admin-workflow/ paths for scripting keywords until patching is complete.

bash

# Example WAF-style pattern to flag suspicious workflow definition updates
# (adapt to your WAF/IDS syntax; block or alert on matches)
URI_PATH  contains  "/o/headless-admin-workflow/v1.0/workflow-definitions"
METHOD    in        ("POST", "PUT", "PATCH")
BODY      matches   "(?i)(<script[^>]*>.*(Runtime|ProcessBuilder|exec|Groovy|bash|cmd\\.exe))"
ACTION    = block_and_log