CVE-2023-33950

The vulnerability resides in the Pattern Redirects feature of Liferay Portal and DXP. The application allows administrators to define URL redirect patterns using regular expressions. Due to insufficient validation, patterns can include regular expressions that are susceptible to ReDoS (Regular Expression Denial of Service) attacks [1][3].

An unauthenticated remote attacker can exploit this by sending a specially crafted request URL that triggers catastrophic backtracking in the regex engine. No authentication or special privileges are required; the attacker only needs to make HTTP requests to the affected server [1].

Successful exploitation causes excessive CPU consumption, leading to denial of service. The server may become unresponsive to legitimate requests, impacting availability [1][3].

Liferay has acknowledged the issue. The vulnerability affects Liferay Portal 7.4.3.48 through 7.4.3.76 and Liferay DXP 7.4 update 48 through 76. Users are advised to update to a patched version or apply workarounds as described in the vendor advisory [3].