CVE-2024-8980: Liferay DXP CSRF Vulnerability

CVE-2024-8980 Overview

CVE-2024-8980 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Script Console of Liferay Portal and Liferay Digital Experience Platform (DXP). The Script Console does not sufficiently validate request origin, allowing remote attackers to execute arbitrary Groovy scripts through a crafted URL or by chaining with a Cross-Site Scripting (XSS) flaw. Successful exploitation requires an authenticated administrator to visit an attacker-controlled page. The issue affects a wide range of Liferay Portal versions from 7.0.0 through 7.4.3.101 and multiple DXP release lines from 6.2 through 2023.Q3.

Critical Impact

An attacker who tricks an authenticated administrator into visiting a malicious URL can execute arbitrary Groovy script inside the portal, gaining server-side code execution in the context of the Liferay application.

Affected Products

• Liferay Portal 7.0.0 through 7.4.3.101 (including 6.2 GA through fix pack 173, 7.1 GA through fix pack 28, 7.2 GA through fix pack 20, 7.3 GA through update 35)
• Liferay Digital Experience Platform (DXP) 7.4 GA through update 92
• Liferay DXP 2023.Q3.1 through 2023.Q3.4

Discovery Timeline

• 2024-10-22 - CVE-2024-8980 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8980

Vulnerability Analysis

The Liferay Script Console is an administrative feature that lets privileged users run Groovy, JavaScript, Python, and Ruby scripts inside the running portal. Because these scripts execute inside the Java Virtual Machine hosting Liferay, they can read data, invoke internal APIs, and interact with the host operating system.

The endpoint responsible for executing submitted scripts does not enforce sufficient anti-CSRF protections. Requests that reach the console are processed on behalf of the currently authenticated user without a reliable check confirming the request originated from the Liferay interface itself.

The practical result is arbitrary server-side code execution scoped to the Liferay process. An attacker chaining this with a stored or reflected XSS flaw in the same origin can trigger execution without any user interaction beyond viewing the injected content.

Root Cause

The root cause is missing or insufficient CSRF token validation on the Script Console execution handler [CWE-352]. The handler trusts the session cookie of the requesting browser to determine authorization but does not verify that the request was intentionally initiated from a legitimate Liferay page.

Attack Vector

Exploitation is network-based and requires user interaction from an authenticated administrator. A typical attack flow proceeds as follows:

1. The attacker crafts a page hosting an auto-submitting HTML form or image tag that issues a POST or GET request to the Liferay Script Console endpoint with a Groovy payload as a parameter.
2. An authenticated Liferay administrator visits the attacker-controlled page while holding a valid session cookie for the target portal.
3. The browser forwards the session cookie with the cross-origin request, and Liferay executes the attacker-supplied Groovy script server-side.

Alternatively, if the attacker controls an XSS sink within the Liferay origin, the CSRF request can be issued from the victim's own browser without leaving the trusted domain, bypassing SameSite cookie restrictions.

See the Liferay Security Advisory CVE-2024-8980 for vendor-supplied technical details.

Detection Methods for CVE-2024-8980

Indicators of Compromise

• Unexpected POST or GET requests to Script Console URLs such as /group/control_panel/manage?p_p_id=com_liferay_server_admin_web_portlet_ServerAdminPortlet containing script, language, or groovy parameters.
• HTTP Referer headers on Script Console requests that point to external or unfamiliar domains, or requests with a missing Referer entirely.
• New scheduled jobs, files written under Liferay data directories, or outbound network connections spawned by the JVM shortly after an administrator session accessed an untrusted site.

Detection Strategies

• Enable audit logging on administrative portlets and alert on any invocation of the Script Console outside approved change windows or by unexpected user accounts.
• Deploy a web application firewall rule that inspects Script Console endpoints for cross-origin request headers and blocks requests missing valid CSRF tokens.
• Correlate Liferay access logs with endpoint telemetry to identify Groovy execution followed by shell, java, or bash child processes originating from the application server user.

Monitoring Recommendations

• Monitor authentication events for Liferay administrators and flag script execution activity that occurs immediately after a browsing session on an unrelated web page.
• Track outbound network connections from the Liferay application server process to detect data exfiltration or command-and-control traffic following script execution.
• Ingest Liferay portal logs into a centralized SIEM and build detection rules for ScriptingUtil, GroovyExecutor, or runScript invocations paired with administrative session identifiers.

How to Mitigate CVE-2024-8980

Immediate Actions Required

• Restrict access to the Script Console to a small set of accounts and, where possible, disable the feature in production environments that do not require it.
• Require administrators to use a dedicated, hardened browser profile for Liferay administration to reduce exposure to cross-origin requests from unrelated tabs.
• Enforce short session timeouts and require re-authentication before allowing access to administrative portlets.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2024-8980. Administrators running Liferay Portal 7.0.0 through 7.4.3.101, Liferay DXP 7.4 GA through update 92, DXP 7.3 GA through update 35, DXP 7.2 GA through fix pack 20, DXP 7.1 GA through fix pack 28, DXP 7.0 GA through fix pack 102, DXP 6.2 GA through fix pack 173, and DXP 2023.Q3.1 through 2023.Q3.4 should apply the vendor-supplied fix pack, update, or quarterly release that addresses this advisory.

Workarounds

• Place the Liferay administrative interface behind a VPN or IP allowlist so that Script Console endpoints are unreachable from arbitrary internet origins.
• Configure the reverse proxy or WAF to strip or reject requests to Script Console URLs that lack a same-origin Origin or Referer header.
• Set session cookies to SameSite=Strict where compatible with the deployment to reduce the reliability of cross-site cookie inclusion on state-changing requests.