CVE-2021-33330

Vulnerability

In Liferay Portal 7.2.0 through 7.3.2 and Liferay DXP 7.2 before fix pack 9, Cross-Origin Resource Sharing (CORS) protected resources can be accessed if the user is authenticated only using portal session authentication. This allows an attacker to bypass CORS restrictions. [1]

Exploitation

An attacker, able to make cross-origin requests to the target Liferay instance, can exploit this by tricking an authenticated user into visiting a malicious page. The attacker then obtains the user's email address and current CSRF token. [1]

Impact

Successful exploitation results in the disclosure of sensitive information, including the targeted user's email address and CSRF token. The CSRF token can be used to perform arbitrary actions on behalf of the user within the Liferay portal. [1]

Mitigation

Liferay DXP 7.2 should be upgraded to fix pack 9 or later. Liferay Portal users should upgrade to version 7.3.3 or later. If patching is not immediately possible, additional CORS configuration or CSRF token rotation may be considered. [1]