CVE-2023-33948

Overview

The Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 lacks proper access control, allowing remote attackers to download arbitrary files from the Document and Media library. This occurs because the module does not restrict which files can be downloaded when a form is submitted via a crafted URL [1].

Exploitation

An attacker can exploit this vulnerability by constructing a specially crafted URL that triggers the download of any file stored in the Document and Media repository. No authentication is required, making the attack vector accessible to anyone with network access to the affected Liferay instance.

Impact

Successful exploitation enables an attacker to retrieve any file from the Document and Media library, including sensitive documents, potentially leading to data breaches and unauthorized disclosure of confidential information.

Mitigation

Liferay has acknowledged this vulnerability. Users should upgrade to patched versions (e.g., Liferay Portal 7.4.3.68+ or DXP 7.4 update 68+) once available. As a general precaution, restrict network access to Liferay forms and monitor for suspicious download requests.