Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3,

Successful exploitation of CVE-2024-25602 allows an attacker to inject malicious JavaScript code into the Liferay Portal environment. This code can then be executed in the context of other users accessing the affected page, potentially leading to account takeover, data theft, or defacement of the portal. An attacker could craft a payload within the 'Name' field of an organization's user profile, which, when viewed by other authenticated users, would trigger the malicious script. The blast radius extends to all authenticated users who view the profile containing the injected script, making it a significant security risk. This vulnerability shares similarities with other XSS exploits where user-supplied data is not properly sanitized before being rendered in a web page.

Organizations heavily reliant on Liferay Portal for user management and internal applications are at significant risk. Specifically, deployments with older, unsupported versions of Liferay Portal or DXP are particularly vulnerable, as they no longer receive security updates. Shared hosting environments where multiple organizations share the same Liferay instance are also at increased risk, as a compromise of one user account could potentially impact other tenants.

• linux / server:

journalctl -u liferay -g "XSS injection"

• generic web:

curl -I 'https://<liferay_portal_url>/users/admin/edit-user?organizationName=<xss_payload>' | grep 'Content-Security-Policy'

• wordpress / composer / npm: (Not applicable - Liferay is not a WordPress/Composer/npm project) • database (mysql, redis, mongodb, postgresql): (Not applicable - XSS is a web vulnerability) • windows / supply-chain: (Not applicable - Liferay is not a Windows/supply-chain application)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. Reserviert2024-02-08
2. Veröffentlicht2024-02-21
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-25602 is to upgrade Liferay Portal to version 7.4.3 or later. If immediate upgrading is not feasible, consider implementing temporary workarounds. Input validation and output encoding on the 'Name' field can help reduce the attack surface, although this is not a complete solution. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the Users Admin module can provide an additional layer of defense. Monitor Liferay Portal logs for suspicious activity, particularly attempts to inject unusual characters or scripts into user profile fields. After upgrading, confirm the fix by attempting to inject a simple XSS payload into the 'Name' field and verifying that it is properly sanitized.