Gespeicherte Cross-Site Scripting (XSS) Schwachstelle in der Suchergebnis-App des Portal Search Moduls in Liferay Portal 7.2.0 bis 7.4.3.11 und älteren nicht unterstützten Versionen, und Liferay DXP 7.4 vor upd

Successful exploitation of CVE-2024-25145 allows an attacker to execute malicious JavaScript code within the context of a user's browser session. This can lead to various consequences, including session hijacking, credential theft, defacement of the Liferay Portal interface, and redirection to malicious websites. The attacker needs to be an authenticated user of the portal to inject the malicious content. The impact is particularly severe because the vulnerability resides within a core search functionality, potentially affecting a large number of users and administrators who rely on search results for their daily tasks. The ability to inject arbitrary HTML also expands the attack surface beyond simple script execution, allowing for more sophisticated attacks.

Organizations using Liferay Portal for internal collaboration, content management, or customer portals are at risk. Specifically, deployments with highlighting enabled in the Search Result app and where user-generated content is frequently added are particularly vulnerable. Legacy Liferay Portal installations running unsupported versions are also at significant risk due to lack of security updates.

• linux / server:

journalctl -u liferay -g "search result app"

• generic web:

curl -I https://your-liferay-portal/search-result-app?q=test | grep -i content-security-policy

• wordpress / composer / npm: (Not applicable, as Liferay is not a WordPress, Composer, or npm-based application) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability is not directly related to database configuration) • windows / supply-chain: (Not applicable, as Liferay is a Java-based application)

1. 2024-02-07Disclosure

   disclosure

1. Reserviert2024-02-06
2. Veröffentlicht2024-02-07
3. Geändert2024-08-22
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-25145 is to upgrade Liferay Portal to version 7.4.4 or later. If upgrading immediately is not feasible, consider disabling highlighting in the Search Result app as a temporary workaround. While this reduces functionality, it prevents the injection of malicious scripts. Review and audit all user-generated content added to the portal, particularly blog posts, message board messages, and web content articles, to identify and remove any potentially malicious scripts. Implement a Web Application Firewall (WAF) with XSS filtering rules to detect and block malicious requests. Regularly scan the Liferay Portal instance for vulnerabilities using a reputable vulnerability scanner.