Multiple vulnerabilities have been reported in Liferay Portal, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks.

1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. disclose potentially sensitive information by tricking a logged in user into visiting a malicious web site.

This vulnerability is reported in versions 6.1 CE and 6.1 EE.

2) Input passed to the "uploadProgressId" parameter in html/portal/upload_progress_poller.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Certain input passed to the "ckEditorConfigFileName" parameter when editing articles in a journal is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

4) Certain input passed to the "_16_chartId" parameter when viewing the currency converter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

5) Certain input passed to the "tag" parameter when viewing blog categories is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

These vulnerabilities are reported in versions 5.2 and prior, 6.1 CE and prior, and 6.1 EE and prior.

Solution
Filter malicious characters and character sequences using a proxy. Do not browse untrusted sites or follow untrusted links while being logged-in to the application.

Provided and/or discovered by
Jelmer Kuperus

Original Advisory
Liferay Portal:
http://issues.liferay.com/browse/LPS-27174

Jelmer Kuperus:
http://packetstormsecurity.org/files/112746/Liferay-6.1-Cross-Site-Request-Forgery.html
http://packetstormsecurity.org/files/112737/Liferay-5.x-6.x-Cross-Site-Scripting.html

Deep Links
Links available to Secunia VIM customers