Remote Code Execution Vulnerability in Liferay Object Service Package
Summary
GHSA-m5gv-vj3f-6v2p: Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations. Affects com.liferay:com.liferay.object.service versions < 1.0.96. Fixed in 1.0.96. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Liferay Object Service package, part of the Liferay Portal and DXP ecosystem, provides functionalities for managing and manipulating objects within the platform. It allows administrators to create, manage, and execute actions on various data objects. However, certain versions of this package are vulnerable to a security flaw that permits unauthorized execution of Groovy scripts by admin users, potentially leading to severe security breaches.
Vulnerability Detail
In Liferay Portal versions 7.4.3.27 to 7.4.3.42 and Liferay DXP versions 2024.Q1.1 to 2024.Q1.20, as well as earlier versions, the Objects module fails to restrict the execution of Groovy scripts in Object actions for users with the Instance Administrator role. This oversight allows remote authenticated admin users to execute arbitrary Groovy scripts, leading to remote code execution (RCE). The vulnerability arises from inadequate access controls and poses significant risks, including unauthorized data manipulation and system compromise.
How To Fix
Minimum fixed version
1.0.96
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of Groovy scripts in Object actions until the package is updated. This can be done by reviewing the instance settings and ensuring that Groovy script execution is restricted for admin users.
Conclusion
The vulnerability in the Liferay Object Service package poses significant risks due to the potential for remote code execution by admin users. It is crucial for affected users to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for com.liferay:com.liferay.object.service →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
Liferay Portal versions 7.4.3.27 to 7.4.3.42 and Liferay DXP versions 2024.Q1.1 to 2024.Q1.20 are affected.
If exploited, an attacker could execute arbitrary Groovy scripts, leading to unauthorized access, data manipulation, or complete system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file, providing real-time insights into potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.object.service.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
