Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service

Successful exploitation of CVE-2024-25601 allows an attacker to inject malicious JavaScript code into the Liferay Portal environment. This code can then be executed in the context of other authenticated users who view the affected geolocation custom field. The attacker could potentially steal session cookies, redirect users to phishing sites, or modify the content displayed on the portal. The blast radius extends to all authenticated users who interact with custom fields utilizing the geolocation feature. This vulnerability is particularly concerning given the prevalence of Liferay Portal in enterprise environments and the potential for widespread impact.

Organizations using Liferay Portal 7.2.0 through 7.4.2, particularly those with custom applications or integrations that heavily rely on geolocation custom fields, are at significant risk. Shared hosting environments where multiple users have access to Liferay Portal instances are also particularly vulnerable.

• linux / server:

journalctl -u liferay -g 'geolocation custom field' | grep -i '<script' 

• generic web:

curl -I 'https://your-liferay-portal/your/geolocation/custom/field?name=<script>alert(1)</script>' | grep 'Content-Type: text/html' 

1. 2024-02-21Disclosure

   disclosure

1. Reserviert2024-02-08
2. Veröffentlicht2024-02-21
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-25601 is to upgrade to Liferay Portal version 7.4.3 or later. If upgrading immediately is not feasible, consider restricting access to the geolocation custom fields or implementing strict input validation on the 'name' text field. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting custom fields can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly attempts to inject script tags or event handlers into custom field names. After upgrading, confirm the fix by attempting to inject a simple XSS payload into a geolocation custom field and verifying that it is properly sanitized.