फ्रंटएंड JS मॉड्यूल के portlet.js में क्रॉस-साइट स्क्रिप्टिंग (XSS) भेद्यता Liferay Portal 7.2.0 से 7.4.3.37, और Liferay DXP 7.4 अपडेट 38 से पहले, 7.3 अपडेट 11 से पहले, 7.2 फिक्स पैक 20 से पहले, और पुराने अनुपलब्ध संस्करणों में।

Successful exploitation of CVE-2024-26269 allows an attacker to inject malicious JavaScript code into a Liferay Portal page viewed by other users. This can lead to a variety of attacks, including session hijacking, credential theft, and defacement of the portal. The attacker could potentially gain complete control over user accounts, access sensitive data, and even compromise the entire Liferay instance. The anchor (hash) portion of a URL is the attack vector, making it relatively easy to craft malicious links and distribute them to unsuspecting users. This vulnerability is particularly concerning given Liferay's widespread use in enterprise environments, where sensitive data and critical business processes are often managed.

Organizations using Liferay Portal and DXP versions 7.2.0 through 7.4.3.37 are at risk. This includes businesses relying on Liferay for content management, collaboration, and digital experience delivery. Shared hosting environments where multiple customers share the same Liferay instance are particularly vulnerable, as an attacker could potentially compromise other tenants.

• linux / server:

journalctl -u liferay-portal | grep -i 'script' -i 'html'

• generic web:

curl -I https://your-liferay-portal/some/page#<script>alert('XSS')</script> | grep -i 'content-type'

• wordpress / composer / npm: (Not applicable, as Liferay is not a WordPress/Composer/npm component) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability is in the frontend JS) • windows / supply-chain: (Not applicable, as Liferay is a Java application)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. आरक्षित2024-02-15
2. प्रकाशित2024-02-21
3. संशोधित2025-04-22
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-26269 is to upgrade Liferay Portal to version 7.4.4 or later. If immediate upgrading is not possible, consider implementing temporary workarounds. Input validation and output encoding on the affected portlet.js component can help reduce the attack surface, though this is not a substitute for patching. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly unusual JavaScript execution patterns or attempts to access sensitive data.