Liferay Portal and Liferay DXP Denial-of-Service Vulnerability via Unrestricted Headless API Response Size

A denial-of-service vulnerability has been identified in Liferay Portal versions 7.4.0 to 7.4.3.99, as well as in Liferay DXP versions 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. The issue arises because these versions do not limit the number of objects returned in Headless API responses. This lack of restriction enables remote attackers to execute requests that generate large volumes of data, potentially overwhelming the application and causing service disruptions.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, where the application becomes unresponsive or significantly degraded in performance due to the excessive load from the unregulated API response.

Remediation

Users can upgrade to Liferay Portal 7.4.3.100 or Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, or 7.3 U36 to address this vulnerability.