CVE-2024-25152: XSS in Liferay Portal 7.2 - 7.4

Successful exploitation of CVE-2024-25152 allows an attacker to inject malicious JavaScript code into the Liferay Portal environment. This code executes within the context of other authenticated users' browsers when they interact with the Message Board widget. The attacker can then steal session cookies, redirect users to phishing sites, deface the website, or execute arbitrary actions on behalf of the victim user. The impact is particularly severe because the vulnerability is stored, meaning the malicious script persists until removed, potentially affecting numerous users. This is similar to other XSS vulnerabilities where attackers leverage user input to inject malicious code, but the attachment filename vector provides a subtle and potentially overlooked attack surface.

1. Reserved2024-02-06
2. Published2024-02-21
3. Modified2024-08-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-25152 is to upgrade Liferay Portal to version 7.4.3 or later. If immediate upgrading is not possible, consider implementing input validation and sanitization on attachment filenames within the Message Board widget. While not a complete solution, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the Message Board widget can provide an additional layer of defense. Monitor Liferay logs for suspicious activity related to attachment uploads and unusual script execution. After upgrading, confirm the fix by attempting to upload an attachment with a malicious filename and verifying that the script is not executed.