CVE-2024-25601: XSS in Liferay Portal 7.2 - 7.4.2

Successful exploitation of CVE-2024-25601 allows an attacker to inject malicious JavaScript code into the Liferay Portal environment. This code can then be executed in the context of other authenticated users who view the affected geolocation custom field. The attacker could potentially steal session cookies, redirect users to phishing sites, or modify the content displayed on the portal. The blast radius extends to all authenticated users who interact with custom fields utilizing the geolocation feature. This vulnerability is particularly concerning given the prevalence of Liferay Portal in enterprise environments and the potential for widespread impact.

1. Reserved2024-02-08
2. Published2024-02-21
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-25601 is to upgrade to Liferay Portal version 7.4.3 or later. If upgrading immediately is not feasible, consider restricting access to the geolocation custom fields or implementing strict input validation on the 'name' text field. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting custom fields can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly attempts to inject script tags or event handlers into custom field names. After upgrading, confirm the fix by attempting to inject a simple XSS payload into a geolocation custom field and verifying that it is properly sanitized.