CVE-2024-26269: Liferay Portal XSS Vulnerability

CVE-2024-26269 Overview

CVE-2024-26269 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the Frontend JS module's portlet.js component of Liferay Portal and Liferay Digital Experience Platform (DXP). Remote attackers can inject arbitrary web script or HTML through the anchor (hash) portion of a URL, which the vulnerable JavaScript processes without proper sanitization. Successful exploitation requires user interaction, typically by convincing a victim to click a crafted link. The flaw affects Liferay Portal 7.2.0 through 7.4.3.37 and multiple DXP release branches.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated Liferay session, enabling session token theft, phishing, and unauthorized actions on behalf of the victim.

Affected Products

Liferay Portal 7.2.0 through 7.4.3.37
Liferay DXP 7.4 before update 38, 7.3 before update 11, and 7.2 before fix pack 20
Older unsupported Liferay Portal and DXP releases

Discovery Timeline

2024-02-21 - CVE-2024-26269 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26269

Vulnerability Analysis

The vulnerability resides in portlet.js, a client-side JavaScript module within Liferay's Frontend JS package. The module processes the anchor (fragment) portion of the current URL and writes attacker-controlled content into the DOM without adequate encoding. Because the exploit payload lives in the URL fragment, it is not sent to the server, which reduces visibility for server-side filters and web application firewalls.

Exploitation requires the victim to visit a crafted Liferay URL. Once the page loads, the malicious script executes in the victim's browser under the origin of the Liferay site. This grants the attacker access to session cookies, CSRF tokens, and any client-side data available to authenticated users. Because the scope is changed [S:C in the CVSS vector], the impact can extend beyond the vulnerable component to other resources within the same origin.

Root Cause

The root cause is improper neutralization of input during web page generation, mapped to [CWE-79]. Client-side JavaScript in portlet.js reads window.location.hash (or an equivalent anchor value) and injects it into HTML sinks without contextual output encoding. This creates a DOM-based XSS sink reachable by any user who follows a specially crafted link.

Attack Vector

The attack is network-based and requires no authentication, but does require user interaction. A typical attack flow proceeds as follows:

The attacker crafts a URL pointing to a legitimate Liferay Portal or DXP site with a malicious payload placed after the # fragment identifier.
The attacker delivers the URL through phishing email, chat, malicious advertising, or a compromised third-party site.
The victim's browser loads the Liferay page and portlet.js renders the fragment into the DOM.
The injected script executes in the victim's session context, allowing cookie theft, unauthorized API calls, or redirection to attacker-controlled infrastructure.

Because the payload resides in the URL fragment, it never traverses network intermediaries or server logs, complicating detection. Refer to the Liferay Security Advisory CVE-2024-26269 for vendor-specific technical details.

Detection Methods for CVE-2024-26269

Indicators of Compromise

Web server or reverse proxy logs showing repeated requests to Liferay pages from a single referrer with unusual client-side error patterns.
Browser telemetry or Content Security Policy (CSP) violation reports referencing inline script execution originating from URL fragments.
Unexpected outbound requests from user browsers to unfamiliar domains shortly after visiting a Liferay URL.
Session anomalies such as concurrent logins, token reuse from new IP addresses, or unauthorized administrative changes.

Detection Strategies

Deploy CSP headers with report-uri or report-to directives to capture attempts to execute injected script.
Inspect referrer and access logs for Liferay URLs containing suspicious fragment content such as %3Cscript, javascript:, or onerror=. Note that fragments are not sent to the server, so client-side telemetry is required for full visibility.
Use browser-based real user monitoring (RUM) or endpoint detection to flag script execution originating from unexpected sources.
Correlate authentication events with URL access patterns to identify session hijacking following a suspicious click.

Monitoring Recommendations

Enable verbose audit logging on Liferay administrative actions and monitor for changes performed shortly after user link clicks.
Forward CSP violation reports and Liferay access logs to a centralized SIEM for correlation with identity and endpoint telemetry.
Track version and patch inventory of all Liferay Portal and DXP instances to prioritize upgrade waves.

How to Mitigate CVE-2024-26269

Immediate Actions Required

Identify all Liferay Portal and DXP instances in the environment and confirm their exact version and fix pack or update level.
Apply the vendor-provided updates: DXP 7.4 update 38, DXP 7.3 update 11, DXP 7.2 fix pack 20, or a Liferay Portal release later than 7.4.3.37.
Rotate session tokens and force re-authentication for privileged users if exploitation is suspected.
Communicate risk to users and recommend caution when clicking Liferay links received from external sources.

Patch Information

Liferay has released fixes documented in the Liferay Security Advisory CVE-2024-26269. Upgrade Liferay DXP 7.4 to update 38 or later, DXP 7.3 to update 11 or later, DXP 7.2 to fix pack 20 or later, and Liferay Portal to a version newer than 7.4.3.37. Older unsupported versions require migration to a supported release.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to reduce DOM-based XSS impact.
Deploy a web application firewall rule that inspects and blocks requests where the URL fragment contains encoded script markers, recognizing that fragments are only visible client-side without additional tooling.
Configure HttpOnly and Secure flags on session cookies to limit the value of stolen tokens.
Restrict administrative access to Liferay to trusted network segments until patching is complete.

bash

# Example Content Security Policy header for Liferay reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; report-uri /csp-report";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";