Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack

The impact of this XSS vulnerability is significant. An attacker can inject arbitrary JavaScript code into a user's browser session, allowing them to execute malicious actions as that user. This could include stealing session cookies, redirecting users to phishing sites, modifying page content, or even gaining complete control of the user's account. The vulnerability’s location within HtmlUtil.escapeJsLink suggests that it could be triggered through various input vectors, making exploitation relatively straightforward. Successful exploitation could compromise sensitive data stored within Liferay Portal, including user credentials, configuration settings, and business-critical information. Given the widespread use of Liferay Portal in enterprise environments, the potential blast radius of this vulnerability is substantial.

Organizations heavily reliant on Liferay Portal for content management, intranet portals, or customer-facing applications are at significant risk. Specifically, deployments using older, unsupported versions of Liferay Portal are particularly vulnerable, as they no longer receive security updates. Shared hosting environments where multiple tenants share the same Liferay Portal instance are also at increased risk, as a compromise of one tenant could potentially affect others.

• linux / server:

journalctl -u liferay-portal | grep -i "javascript:"

• generic web:

curl -I <liferay_portal_url>/path/to/vulnerable/endpoint | grep -i "Content-Security-Policy"

• wordpress / composer / npm: (Not applicable, as Liferay is not a WordPress/Composer/npm component) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability is not database-related) • windows / supply-chain: (Not applicable, as the vulnerability is not Windows/supply-chain related)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. Reserviert2024-02-06
2. Veröffentlicht2024-02-21
3. Geändert2025-04-22
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-25147 is to upgrade to Liferay Portal version 7.4.2 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Input validation and sanitization on all user-supplied data is crucial. Web Application Firewalls (WAFs) can be configured to detect and block malicious JavaScript payloads. Review and tighten access controls to limit the potential impact of a successful attack. Monitor Liferay Portal logs for suspicious activity, particularly unusual JavaScript execution patterns. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a known malicious payload and verifying that the input is properly sanitized.