CVE-2023-33949

Vulnerability

Description CVE-2023-33949 is a configuration vulnerability in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier. The default setting for the portal property company.security.strangers.verify is false, meaning that new user registrations do not require email address verification. This allows anyone to create an account using any email address, including fake ones or addresses they do not control [1].

Exploitation

An attacker can exploit this by simply registering a new account on a vulnerable Liferay instance. No authentication or special privileges are needed; the attack can be performed remotely over the network. The absence of email verification means the attacker can use any arbitrary email address, potentially impersonating existing users or creating multiple accounts for abuse [3].

Impact

Successful exploitation grants the attacker a valid account on the Liferay system. Depending on the portal's configuration, this could lead to unauthorized access to restricted content, spam, or further attacks such as privilege escalation if combined with other vulnerabilities. The impact is elevated because the attacker can create accounts without any legitimate email ownership [1][3].

Mitigation

The recommended mitigation is to set the portal property company.security.strangers.verify to true in the portal-ext.properties file. This enforces email verification for new registrations. Liferay has addressed this issue in newer versions; users should upgrade to Liferay Portal 7.4.0 or later, or Liferay DXP 7.3 and later, where the default is true [1][3].