Listen to this Post
How the mentioned CVE works:
This CVE is an Insecure Direct Object Reference (IDOR) vulnerability within Liferay Portal’s audit event handling. The application exposes an endpoint for fetching specific audit events, identified by an `auditEventId` parameter. The vulnerability exists because the application fails to properly verify if the requested audit event belongs to the same virtual instance as the authenticated user making the request. A remote attacker, authenticated with a standard user account on one virtual instance, can manipulate the `_com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId` parameter to reference an audit event ID from a completely different, separate virtual instance. The server’s authorization check is insufficient, as it does not validate the virtual instance context of the object being accessed. Consequently, the server returns the sensitive audit event details, which can contain logs of user actions and system events, from an unauthorized virtual instance, leading to a cross-instance information disclosure.
Platform: Liferay Portal/DXP
Version: 7.4.0-7.4.3.117
Vulnerability : IDOR
Severity: Moderate
date: 2024-10-01
Prediction: 2024-10-29
What Undercode Say:
curl -s "http://target:8080/group/guest/~/control_panel/manage?p_p_id=com_liferay_portal_security_audit_web_portlet_AuditPortlet&p_p_lifecycle=2&_com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId=12345" -H "Cookie: ..."
// Example flawed authorization logic
AuditEvent auditEvent = AuditEventLocalServiceUtil.getAuditEvent(auditEventId);
// Missing check: if (auditEvent.getCompanyId() != user.getCompanyId()) { throw ... }
return auditEvent;
How Exploit:
1. Attacker authenticates to Instance A.
- Attacker discovers valid audit event IDs for Instance B.
3. Attacker requests `/group/guest/…AuditPortlet…auditEventId=[bash]`.
4. Server returns Instance B’s audit log.
Protection from this CVE
Apply vendor patch.
Implement instance checks.
Validate object ownership.
Use access control lists.
Impact:
Cross-instance data leak.
Audit log exposure.
Information disclosure.
Privacy violation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
