CVE-2024-25145: XSS in Liferay Portal Search Module

Successful exploitation of CVE-2024-25145 allows an attacker to execute malicious JavaScript code within the context of a user's browser session. This can lead to various consequences, including session hijacking, credential theft, defacement of the Liferay Portal interface, and redirection to malicious websites. The attacker needs to be an authenticated user of the portal to inject the malicious content. The impact is particularly severe because the vulnerability resides within a core search functionality, potentially affecting a large number of users and administrators who rely on search results for their daily tasks. The ability to inject arbitrary HTML also expands the attack surface beyond simple script execution, allowing for more sophisticated attacks.

1. Reserved2024-02-06
2. Published2024-02-07
3. Modified2024-08-22
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-25145 is to upgrade Liferay Portal to version 7.4.4 or later. If upgrading immediately is not feasible, consider disabling highlighting in the Search Result app as a temporary workaround. While this reduces functionality, it prevents the injection of malicious scripts. Review and audit all user-generated content added to the portal, particularly blog posts, message board messages, and web content articles, to identify and remove any potentially malicious scripts. Implement a Web Application Firewall (WAF) with XSS filtering rules to detect and block malicious requests. Regularly scan the Liferay Portal instance for vulnerabilities using a reputable vulnerability scanner.