Listen to this Post
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability within the commerce order notes functionality of Liferay Portal and DXP. The flaw exists because the application does not properly verify user permissions when processing requests to add notes to a commerce order. A remote attacker, authenticated to one virtual instance (a segregated tenant environment), can exploit this by manipulating the `_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId` HTTP parameter. By supplying the ID of an order belonging to a different, target virtual instance, the attacker can successfully add a note to that foreign order. This action violates the intended multi-tenancy security boundaries, allowing unauthorized data modification across instances. The vulnerability is present in specific versions of Liferay Portal 7.3, 7.4, and Liferay DXP 2023.Q3, 2023.Q4, and 7.4 GA.
Platform: Liferay Portal/DXP
Version: 7.3.5-7.4.3.112
Vulnerability: IDOR
Severity: Moderate
date: 2025-09-22
Prediction: 2025-10-06
What Undercode Say:
curl -X POST 'http://<target>/group/guest/commerce-order' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d '_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId=<CROSS_INSTANCE_ORDER_ID>' \ -d 'note=Injected+Note'
// Hypothetical vulnerable code snippet lacking instance validation
public void addNote(ActionRequest request) {
long commerceOrderId = ParamUtil.getLong(request, "commerceOrderId");
// Missing check: currentUserInstance == orderInstance
commerceOrderNoteService.addNote(commerceOrderId, noteContent);
}
How Exploit:
Authenticated user manipulates commerceOrderId parameter to reference an order in another virtual instance, submitting a POST request to add a note, bypassing tenant isolation.
Protection from this CVE
Apply vendor patch to version 11.0.164 (Liferay Portal) or respective fixed DXP versions. Implement server-side authorization checks verifying the user’s virtual instance matches the target order’s instance before any operation.
Impact:
Unauthorized cross-instance data modification, breach of multi-tenancy isolation, integrity loss of order data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
