CVE-2024-8980

An attacker can trick a logged-in user (e.g., an administrator) into visiting a crafted URL or page containing malicious XSS code, which in the background sends an unauthorized request to Script Console. Since the application does not properly verify the CSRF token, the request is accepted and executed in the context of the victim's session. As a result, any Groovy script is executed server-side with the privileges of the logged-in user.

An attacker can execute arbitrary server-side code in the Liferay environment, potentially leading to complete application takeover, data theft, content modification, or further lateral movement in the infrastructure.

Apply patches available from the vendor according to references published at https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980. Until the patch is implemented, restrict access to Script Console exclusively to trusted, authenticated administrators and consider blocking access to this function at the firewall or network access control level.

Liferay Portal 7.0.0 – 7.4.3.101; Liferay DXP 2023.Q3.1 – 2023.Q3.4, 7.4 GA – update 92, 7.3 GA – update 35, 7.2 GA – fix pack 20, 7.1 GA – fix pack 28, 7.0 GA – fix pack 102, 6.2 GA – fix pack 173