CVE-2022-42118 is a recent security vulnerability discovered in the Liferay Portal platform, specifically affecting the Portal Search module in versions Liferay Portal 7.1. through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3. This vulnerability, classified as a Cross-site scripting (XSS) vulnerability, allows remote attackers to inject malicious web scripts or HTML into a web application via the tag parameter, potentially compromising the security and functionality of the affected application.

In this post, we'll delve into the details of this security vulnerability, review the relevant code snippets, discuss potential exploitation scenarios, and provide links to the original references. By the end of this article, you should have a better understanding of the risks posed by CVE-2022-42118 and how to protect your Liferay Portal applications from potential attacks.

Code Snippet

The vulnerability exists in the Search Results module due to improper handling and sanitization of user-supplied input in the tag parameter. Here's a sample code snippet that demonstrates the vulnerable code:

// Liferay Portal's Search Module
// Vulnerable Code Snippet
public void search() {
    ...
    String tags = ParamUtil.getString(renderRequest, "tag");
    ...
    // Display search results based on the 'tag' parameter
    ...
}

As you can see, the code fetches the tag parameter value from the user input without proper validation and sanitization, making it susceptible to malicious payloads.

Exploiting the Vulnerability

To exploit this vulnerability, an attacker can inject arbitrary web script or HTML through the tag parameter, which is then rendered in the HTML output of the affected page. Here's a sample payload that can be injected into the vulnerable tag parameter:

<script>alert('XSS Attack');</script>

When a victim visits the Liferay Portal application's search result page containing this payload, the malicious script will be executed, potentially leading to information disclosure, manipulation of web content, or redirection to malicious websites.

Original References

The Liferay Portal team has acknowledged this vulnerability and released patches to address CVE-2022-42118 in the affected versions. You can find more information and recommendations on addressing this vulnerability in the following links:

- Liferay Portal's Security Advisory: https://liferay.dev/announcements/security-advisory
- NVD - National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-42118
- Liferay Portal Upgrade Guide: https://help.liferay.com/hc/en-us/articles/360018165631-Upgrading-to-Liferay-Portal-7-4

Conclusion

CVE-2022-42118 is an important Cross-site scripting (XSS) vulnerability affecting the Portal Search module of Liferay Portal and Liferay DXP. If your application is running on an affected version, it is highly recommended to apply the relevant patches or upgrade to a secure version as soon as possible. Additionally, always validate and sanitize user inputs to minimize the risks posed by similar vulnerabilities. By taking these steps, you can help ensure the continued security of your Liferay Portal applications and protect your users from potential attacks.

Timeline

Published on: 11/15/2022 01:15:00 UTC
Last modified on: 11/17/2022 14:42:00 UTC