External risk intelligence

Liferay Workflow Component Allows Unauthenticated Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2024-38002

Liferay Portal and DXP are enterprise web platforms frequently deployed as public-facing web applications and content management systems. The vulnerability exists within the headless API component, which is a common feature exposed for programmatic interaction in these types of deployments, making the vulnerable surface likely to be reachable from the internet.

Liferay Digital Experience Platform

2023.q3.1 to before 2023.q3.92023.q4.0 to before 2023.q4.67.37.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Liferay Portal and Liferay DXP, affecting their workflow components. This issue allows unauthorized remote users to alter workflow definitions and potentially execute arbitrary code. The primary concern is to confirm whether our environment utilizes the impacted Liferay versions and if the vulnerable workflow component is exposed externally.

Unauthorized users can change workflows.
Critical to confirm relevance to our systems.
Assess exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by targeting the workflow component through the headless API. This allows unauthenticated remote users to modify workflow definitions, bypassing permission checks. Successful manipulation can lead to arbitrary code execution.

No authentication required for access.
Workflow definitions can be altered.
Arbitrary code execution is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote users to modify workflow definitions. When supported by the advisory, this could lead to the execution of arbitrary code, impacting the integrity and availability of the affected Liferay Portal or DXP instances.

Workflow definitions and arbitrary code execution.
Via the headless API without authentication.
Compromise of service integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in Liferay Portal and DXP. The initial practical steps involve identifying all instances of the affected software, confirming their exposure and business criticality, and then locating the accountable asset owners. Remediation planning should follow, prioritizing based on risk.

Identify accountable application owners.
Verify product reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Liferay Portal and Liferay DXP?

Liferay Portal and Liferay DXP are enterprise-grade software platforms used for building web portals, digital experiences, and content management systems. They provide organizations with tools to manage business workflows and publish content. This vulnerability specifically affects the workflow component within these platforms, which manages the lifecycle and approval processes of digital assets.

What is the vulnerability in CVE-2024-38002?

This vulnerability is a failure to verify user permissions, classified under CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). In plain English, the system fails to check if a user is allowed to perform an action before executing it. Because of this, an unauthenticated user can modify workflow definitions, which ultimately allows them to run unauthorized commands on the server.

How do attackers trigger this vulnerability?

An attacker triggers this by sending requests to the headless API, a feature used for programmatic interaction with the portal. The flaw exists because the workflow component does not require a user to log in to process these requests. It is important to note that this is not a general flaw in every API endpoint; the exploit path specifically relies on the workflow definition update functionality.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that Liferay products are frequently deployed as public-facing web applications. Because the vulnerable workflow component is reachable via the headless API, instances that are exposed to the internet are more likely to be reachable by an attacker. Systems residing only on internal networks still require attention, but external-facing instances present the most immediate concern.

What steps should I take to respond?

Begin by creating an inventory of all Liferay Portal and DXP instances within your environment to identify if you are running any of the affected versions. Once you have identified these systems, determine which ones are accessible from the network and confirm who is responsible for managing them. Prioritize these assets for remediation planning based on their importance to your business operations.

References

liferay.dev/portal/security/known-vulnerabilities/-/asset_publish…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.