Liferay Portal e Liferay DXP vulneráveis a Cross-site Scripting (XSS) armazenado

Successful exploitation of CVE-2024-26266 allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser session. This can lead to account takeover, data theft (including sensitive user information stored within Liferay), and defacement of the Liferay Portal instance. The attacker could potentially leverage this to move laterally within the network if the compromised user has elevated privileges or access to other systems. The impact is particularly severe given the widespread use of Liferay Portal in enterprise environments, often handling critical business data and processes.

Organizations utilizing Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP versions prior to update 10 are at risk. This includes businesses relying on Liferay for content management, intranet portals, and customer experience platforms. Shared hosting environments where multiple users have access to create content within Liferay are particularly vulnerable.

• linux / server:

journalctl -u liferay-portal | grep -i "XSS"

• generic web:

curl -I https://<liferay_portal_url>/ | grep -i "X-XSS-Protection"

• wordpress / composer / npm: (Not applicable as Liferay is not a WordPress/Composer/npm component) • database (mysql, redis, mongodb, postgresql): (Not applicable as the vulnerability is not directly related to the database) • windows / supply-chain: (Not applicable as Liferay is not a Windows/supply-chain component)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. Reservado2024-02-15
2. Publicada2024-02-21
3. Modificada2025-01-28
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-26266 is to upgrade Liferay Portal to version 7.4.3.14 or later, or to Liferay DXP to update 10 or later. If immediate upgrading is not possible, consider implementing strict input validation and output encoding on user-supplied data within the Announcement and Alerts widgets. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly related to user profile updates and widget creation. Review user access controls to limit the number of users with the ability to create entries in these widgets.