CVE-2024-25147: XSS in Liferay Portal 7.2 - 7.4

The impact of this XSS vulnerability is significant. An attacker can inject arbitrary JavaScript code into a user's browser session, allowing them to execute malicious actions as that user. This could include stealing session cookies, redirecting users to phishing sites, modifying page content, or even gaining complete control of the user's account. The vulnerability’s location within HtmlUtil.escapeJsLink suggests that it could be triggered through various input vectors, making exploitation relatively straightforward. Successful exploitation could compromise sensitive data stored within Liferay Portal, including user credentials, configuration settings, and business-critical information. Given the widespread use of Liferay Portal in enterprise environments, the potential blast radius of this vulnerability is substantial.

1. Reserved2024-02-06
2. Published2024-02-21
3. Modified2025-04-22
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-25147 is to upgrade to Liferay Portal version 7.4.2 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Input validation and sanitization on all user-supplied data is crucial. Web Application Firewalls (WAFs) can be configured to detect and block malicious JavaScript payloads. Review and tighten access controls to limit the potential impact of a successful attack. Monitor Liferay Portal logs for suspicious activity, particularly unusual JavaScript execution patterns. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a known malicious payload and verifying that the input is properly sanitized.