medium5.3
CVE-2022-25146
Liferay Portal and Liferay DXP fails to check origin of event messages
Impact
The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.remote.app.web | < 2.0.21 | 2.0.21 |
| maven | com.liferay.portal:release.dxp.bom | < 7.4.13.u5 | 7.4.13.u5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Digital Experience Platform | through 7.4 |
| Liferay | Liferay Portal | from 7.4.3.4 before 7.4.3.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps
- https://www.securitum.pl
- https://github.com/advisories/GHSA-ghw5-998m-vw4w
- https://nvd.nist.gov/vuln/detail/CVE-2022-25146
- http://liferay.com
- https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps?p_r_p_assetEntryId=121612000&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612000%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse