Executive Summary

This vulnerability affects the Document Library and Adaptive Media modules in certain versions of Liferay Portal and Liferay DXP. These modules incorrectly set the Cache-Control HTTP header for file downloads by not using a private Cache-Control directive. As a result, local users can access downloaded files through the browser's cache, potentially exposing sensitive data. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows local users to access downloaded files via the browser's cache, which can lead to unintended exposure of sensitive or confidential information stored in those files. This could compromise data privacy and security on affected systems. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the affected Liferay Portal or DXP versions are in use and verifying the Cache-Control HTTP headers for file downloads from the Document Library and Adaptive Media modules. Specifically, you should look for Cache-Control headers that do not include the 'private' directive, which indicates the vulnerability. You can use tools like curl or browser developer tools to inspect these headers. For example, a command to check the header might be: curl -I https://your-liferay-instance/path-to-downloaded-file and look for the Cache-Control header in the response. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading affected Liferay Portal and DXP installations to fixed versions: Liferay Portal 7.4.3.112 or later, and Liferay DXP 2024.Q1.1 or later. Until upgrades can be applied, restrict local user access to systems where downloads occur, and consider clearing browser caches regularly to prevent unauthorized access to cached files. [1]

Useful 0 Not Useful 0