Listen to this Post
The vulnerability exists in the Document Library and Adaptive Media modules of Liferay. These components serve files to users but apply an incorrect Cache-Control HTTP header. This header is responsible for instructing browsers and intermediate caches on how to store the content. The flawed implementation likely uses headers that permit caching of sensitive files, such as “public” or a very long “max-age”, instead of “no-store” or “private”. When a user downloads a file, their browser receives these permissive caching directives. Consequently, the browser saves a copy of the downloaded file in its local cache. A local user with access to the same machine can then browse the browser’s cache storage and retrieve these files, potentially gaining access to sensitive documents that were intended only for the original authenticated user, effectively bypassing the application’s access controls through the cached copy.
Platform: Liferay Portal/DXP
Version: 7.4.0-7.4.3.111
Vulnerability: Cache Misconfiguration
Severity: Medium
date: 2024-08-14
Prediction: 2024-09-15
What Undercode Say:
grep -r "Cache-Control" /path/to/liferay/modules/ curl -I https://liferay-instance.com/documents/12345
// Check response headers in browser
fetch('/documents/12345').then(response => {
console.log(response.headers.get('Cache-Control'));
});
How Exploit:
Access browser cache filesystem. Locate and extract cached Liferay documents.
Protection from this CVE
Apply vendor patch. Configure web server with ‘Cache-Control: no-store’ for sensitive endpoints.
Impact:
Local user information disclosure. Unauthorized file access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
