Listen to this Post
The CVE describes an Insecure Direct Object Reference (IDOR) vulnerability within the Contacts Center widget of the Liferay platform. The flaw exists in the handling of the `_com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId` HTTP parameter. This parameter directly specifies the unique identifier (entryId) of a contact record the user wishes to view. The application fails to perform adequate authorization checks on this user-supplied input. Consequently, a remote attacker can manipulate this parameter’s value, supplying the identifier of any contact record within the system. The application, trusting this input, will retrieve and return the requested contact information without verifying if the authenticated user has the necessary permissions to view that specific record. This allows an attacker to bypass intended access controls and enumerate sensitive personal data, including names and email addresses, belonging to other users.
Platform: Liferay Portal/DXP
Version: < 5.0.59
Vulnerability: IDOR
Severity: Moderate
date: 2025-09-19
Prediction: 2025-10-03
What Undercode Say:
curl -s "http://target/group/guest/~/control_panel/manage?p_p_id=com_liferay_contacts_web_portlet_ContactsCenterPortlet&_com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId=12345" | grep -o "email.@..."
SELECT userId, firstName, lastName, emailAddress FROM Contact_;
How Exploit:
Manipulate the `entryId` parameter in a request to the Contacts Center portlet to access unauthorized contact entries.
Protection from this CVE:
Upgrade to patched version. Implement proper authorization checks. Use indirect reference maps.
Impact:
Unauthorized disclosure of sensitive personal information (PII) including user names and email addresses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
