A Russian government portal running Liferay Community Edition exposed user passwords in plaintext transactional emails, illustrating how default Open Source configurations can undermine even heavily protected state systems and produce a classic CWE-319 vulnerability.
The system was deployed inside a closed government information system (GIS) where every component is expected to undergo strict review. Because commercial Liferay DXP licenses were unavailable under sanctions, engineers selected the free Community Edition hosted on GitHub. Authorization was delegated to external government OAuth 2.0 gateways and CSRF tokens protected the frontend, yet the password-reset workflow remained untouched.
When a user changed their password through a custom portlet, the application invoked Liferay’s default “New Password Notification” template. The template inserted the literal password via the [$PASSWORD$] macro and sent it to the user’s mailbox. The resulting email also carried the developer’s localhost:8080 address in the subject line and retained the American MailEngine domain in the Message-ID header.
Technical evidence found in message source
- Message-ID contained @://liferay.com, the hardcoded default never overridden in portal-ext.properties.
- Subject line revealed “http://localhost:8080: Your New Password”, showing that the [$PORTAL_URL$] variable had not been updated for production.
- Message body contained the actual password in clear text: “Your new password for http://localhost:8080 is HabraHabr1”.
The developers had reused the built-in account-creation trigger instead of creating a dedicated notification that omits the password value. Liferay’s macro is intended only for administrator-initiated temporary passwords; applying it to permanent user-chosen passwords created the dangerous hybrid behavior.
Remediation steps
Security teams can close the exposure without code changes:
- In Control Panel → System Settings → Users, delete the [$PASSWORD$] macro from both Password Changed Notification and New Password Notification templates.
- Edit portal-ext.properties and set web.server.host, web.server.https.port, web.server.protocol, and mail.string.id to production values.
- Restart the application server (Tomcat or WildFly).
The incident demonstrates that even heavily audited Open Source platforms require explicit hardening of notification templates and environment variables before they are placed in high-security government environments.
