Listen to this Post
The Profile widget in Liferay uses a user-supplied name to construct the “Content-Disposition” header when generating a vCard for download. This header dictates the filename for the downloaded file. Because the user-controlled input is not properly sanitized, an authenticated attacker can inject a new file extension. For example, by manipulating their display name to include a malicious extension like “.jsp”, the downloaded vCard file could be saved with a “.jsp” extension instead of the expected “.vcf”. This spoofing attack could potentially trick users or systems into handling the file as an executable script rather than a simple contact file, leading to further exploitation depending on the context and server configuration.
Platform: Liferay Portal/DXP
Version: 7.4.0 – 7.4.3.111
Vulnerability: Extension Spoofing
Severity: Moderate
date: 2025-10-06
Prediction: Patch available
What Undercode Say:
`curl -H “Content-Disposition: attachment; filename=\”user_controlled.jsp\””`
`String fileName = user.getName() + “.vcf”;`
`response.setHeader(“Content-Disposition”, “attachment; filename=\”” + fileName + “\””);`
How Exploit:
Authenticated user modifies profile name to include a malicious extension, triggering a download with a spoofed file type.
Protection from this CVE
Update to Liferay version 7.4.3.112-ga112 or apply vendor patch. Implement server-side input sanitization for filename headers.
Impact:
File extension spoofing, potential client-side code execution, user deception.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
