Liferay Portal and DXP Subdomain Misidentification Leading to Supercookie Vulnerability

A vulnerability exists in Liferay Portal versions 7.4.0 to 7.4.3.105, older unsupported versions, and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. This vulnerability may cause incorrect subdomain identification, leading to the creation of a supercookie. This supercookie allows remote attackers controlling websites with the same top-level domain to read cookies set by the application.

Impact

Exploitation of this vulnerability allows remote attackers to read application-set cookies from users who visit their website, potentially leading to session hijacking or other attacks that rely on cookie data.

Remediation

Users can upgrade to Liferay Portal 7.4.3.106 or Liferay DXP versions 2024.Q1.1, 2023.Q4.1, 2023.Q3.5, or 7.3 U36 to address this vulnerability.