Liferay Portal and Liferay DXP GraphQL Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Liferay Portal versions 7.4.0 to 7.4.3.101, as well as in Liferay DXP versions 2023.Q3.0 to 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35. The issue arises because these versions do not limit the number of objects returned by GraphQL queries. This lack of restriction allows remote attackers to execute queries that retrieve large volumes of data, potentially overwhelming the application and causing service disruptions.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, where the application becomes unresponsive or significantly degraded in performance due to the excessive data processing.

Remediation

Users can upgrade to Liferay Portal 7.4.3.102 or Liferay DXP versions 2023.Q4.0, 2023.Q3.5, or 7.3 U36 to address this vulnerability.