CVE-2024-25603: XSS in Liferay Portal 7.4

Successful exploitation of CVE-2024-25603 allows an attacker to inject malicious JavaScript code into Liferay Portal pages viewed by other authenticated users. This can be leveraged to steal session cookies, redirect users to phishing sites, or modify the content of the portal. The impact is particularly severe because the vulnerability is stored, meaning the injected script persists until removed, potentially affecting a large number of users. An attacker could also use this to gain administrative privileges if the injected script targets administrative functions, leading to complete control of the Liferay instance. This vulnerability shares similarities with other XSS vulnerabilities where malicious scripts are injected into trusted websites to compromise user accounts.

1. Reserved2024-02-08
2. Published2024-02-21
3. Modified2025-01-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-25603 is to upgrade Liferay Portal to version 7.4.3.5 or later. If upgrading immediately is not possible, consider implementing input validation and output encoding on the instanceId parameter within the DDMForm. While not a complete fix, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the DDMForm can also provide a temporary layer of protection. Regularly review and update Liferay Portal's security configuration to ensure best practices are followed. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple script through the DDMForm and verifying it is not executed.