Liferay Portal/DXP MFA Login Bypass via POST-to-GET Method Change

This repository provides a Proof of Concept (PoC) exploit for CVE-2025-3639, a login bypass vulnerability affecting Liferay Portal (versions 7.3.0–7.4.3.132) and Liferay DXP (2024.Q1 to 2025.Q1.6). The exploit demonstrates that an attacker with valid credentials can bypass multi-factor authentication (MFA) by sending a crafted HTTP GET request (instead of the expected POST) to the /c/portal/login endpoint. The repository contains two files: a detailed README.md explaining the vulnerability, usage, and requirements, and poc.py, a Python script that performs the exploit. The script takes the target URL, username, and password as arguments, sends the GET request, and checks for a valid session token in the response cookies. If successful, it prints the session token, indicating unauthorized access to the user account without completing MFA. The exploit is a network-based attack and requires valid credentials but does not require prior authentication. No hardcoded endpoints or IPs are present; the target is user-supplied. The repository is structured as a simple PoC for educational and testing purposes.