Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix

Successful exploitation of CVE-2024-25152 allows an attacker to inject malicious JavaScript code into the Liferay Portal environment. This code executes within the context of other authenticated users' browsers when they interact with the Message Board widget. The attacker can then steal session cookies, redirect users to phishing sites, deface the website, or execute arbitrary actions on behalf of the victim user. The impact is particularly severe because the vulnerability is stored, meaning the malicious script persists until removed, potentially affecting numerous users. This is similar to other XSS vulnerabilities where attackers leverage user input to inject malicious code, but the attachment filename vector provides a subtle and potentially overlooked attack surface.

Organizations heavily reliant on Liferay Portal for content management and collaboration are particularly at risk. Environments where users frequently upload attachments to the Message Board widget, such as internal knowledge bases or forums, face a higher probability of exploitation. Shared hosting environments using Liferay Portal are also vulnerable, as a compromised account on one site could potentially impact other sites on the same server.

• linux / server: Monitor Liferay logs (e.g., liferay.log) for suspicious attachment uploads or script execution attempts. Look for patterns indicative of XSS payloads in filenames.

grep -i 'script|alert|onerror' /opt/liferay/logs/liferay.log

• generic web: Use curl to test the Message Board widget with a specially crafted filename containing XSS payloads. Examine the response for signs of script execution.

curl -X POST -d "filename=<script>alert('XSS')</script>" https://your-liferay-portal/o/message-board/add-attachment

• wordpress / composer / npm: (Not applicable, as this is a Java/Liferay vulnerability) • database (mysql, redis, mongodb, postgresql): (Not applicable) • windows / supply-chain: (Not applicable)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. Reserviert2024-02-06
2. Veröffentlicht2024-02-21
3. Geändert2024-08-26
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-25152 is to upgrade Liferay Portal to version 7.4.3 or later. If immediate upgrading is not possible, consider implementing input validation and sanitization on attachment filenames within the Message Board widget. While not a complete solution, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the Message Board widget can provide an additional layer of defense. Monitor Liferay logs for suspicious activity related to attachment uploads and unusual script execution. After upgrading, confirm the fix by attempting to upload an attachment with a malicious filename and verifying that the script is not executed.