CVE-2022-42121: SQL Injection Vulnerability in com.liferay.layout.page.template.service and com.liferay.portal:release.dxp.bom
Summary
CVE-2022-42121: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module. Affects com.liferay:com.liferay.layout.page.template.service versions < 4.0.17. Fixed in 4.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The packages com.liferay.layout.page.template.service and com.liferay.portal:release.dxp.bom are part of the Liferay Portal and Liferay DXP ecosystems, which are widely used for building enterprise web applications. These packages provide essential services for layout management and portal functionalities. However, they have been identified to contain a critical SQL injection vulnerability that could allow attackers to execute arbitrary SQL commands, posing significant risks to data integrity and security.
Vulnerability Detail
A SQL injection vulnerability exists in the Layout module of Liferay Portal versions 7.1.3 through 7.4.3.4 and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA. This vulnerability allows remote authenticated attackers to inject malicious SQL code through a crafted payload in a page template's 'Name' field. The potential ramifications include unauthorized access to sensitive data, data manipulation, and complete system compromise.
How To Fix
Minimum fixed version
4.0.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization on the 'Name' field of page templates to mitigate the risk of SQL injection. This can be done by ensuring that only expected characters are allowed in the input.
Conclusion
The SQL injection vulnerability CVE-2022-42121 poses a significant risk to Liferay Portal and Liferay DXP users. It is crucial to update to the patched versions of the affected packages to safeguard against potential attacks. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for com.liferay:com.liferay.layout.page.template.service →
FAQ
CVE-2022-42121 is a SQL injection vulnerability found in specific versions of Liferay Portal and Liferay DXP, allowing attackers to execute arbitrary SQL commands.
Affected versions include Liferay Portal 7.1.3 through 7.4.3.4 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to unauthorized access to sensitive data, data manipulation, and potentially a complete system compromise.
Update the packages in your pom.xml file to the patched versions: com.liferay.layout.page.template.service to 4.0.17 and com.liferay.portal:release.dxp.bom to the respective fixed versions.
