CVE-2025-62245: Liferay Portal is vulnerable to CSRF through publication comments

The analysis of the provided patches indicates that the vulnerability is a classic case of Cross-Site Request Forgery (CSRF) within the Liferay Portal's comment publication feature. The root cause of the vulnerability is the lack of proper security checks in the doServeResource method of the UpdateCTCommentMVCResourceCommand class.

The first commit, dd89fff675f04d146fda38a1bec884cf40d0c756, introduces a check to ensure that all requests to this endpoint are of the POST method. This is a standard mitigation for CSRF, as it prevents simple attacks that rely on embedding malicious URLs in iframes or image tags. The fact that this check was missing indicates that the endpoint was previously vulnerable to GET-based CSRF attacks.

The second commit, fa356d07ab239e790b7e460d33c25184aef58716, further strengthens the security of the endpoint by adding a CSRF token check using AuthTokenUtil.checkCSRFToken. This ensures that even POST requests must contain a valid, user-specific token, effectively preventing attackers from forging requests from a different origin.

Based on this evidence, the doServeResource function is identified as the vulnerable function. During an exploit, this function would be present in the runtime profile as it is the entry point for the vulnerable action of adding or editing a publication comment. The patches directly modify this function to add the necessary security controls that were previously absent.