CVE-2021-29041

Vulnerability

The vulnerability resides in the Multi-Factor Authentication module of Liferay DXP 7.3 prior to fix pack 1. A remote authenticated attacker can enable Time-based One-time Password (TOTP) on behalf of another user or modify that user's TOTP shared secret, thereby preventing the targeted user from authenticating. [1]

Exploitation

An attacker must have authenticated access to the Liferay DXP instance. Through the Multi-Factor Authentication module, they can either enable TOTP for another user or alter the existing TOTP shared secret of that user. No additional privileges or user interaction are required. [1]

Impact

Successful exploitation results in a denial-of-service condition: the targeted user is unable to authenticate because their TOTP configuration has been changed or enabled without their consent. This can affect any user, including administrators, potentially leading to a complete lockout of legitimate users. [1]

Mitigation

Liferay released a fix in fix pack 1 for Liferay DXP 7.3. Users should upgrade to the fixed version. No workarounds are documented in the available references. [1]