CVE-2025-43735: Liferay DXP Reflected XSS Vulnerability

CVE-2025-43735 Overview

CVE-2025-43735 is a reflected cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw exists in the google_gadget component and allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered by vulnerable instances. Successful exploitation executes attacker-controlled script in the context of the victim's browser session. The vulnerability is tracked under CWE-79 and is documented in the Liferay CVE-2025-43735 Advisory.

Critical Impact
Unauthenticated attackers can execute JavaScript in victims' browsers, enabling session theft, credential harvesting, and portal user impersonation.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.131
Liferay Portal 7.4 GA through update 92
Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12

Discovery Timeline

2025-08-12 - CVE-2025-43735 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43735

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the google_gadget component of Liferay Portal and DXP. The affected code path returns attacker-supplied input in an HTTP response without proper output encoding. When a victim follows a crafted URL, the injected JavaScript executes in the victim's browser under the origin of the Liferay portal.

Because the vulnerable endpoint does not require authentication, an attacker can weaponize the flaw with a phishing link alone. Payloads run with the privileges of any user who follows the link, including administrators.

Root Cause

The root cause is missing or insufficient neutralization of user-controlled input written to a web page (CWE-79). The google_gadget handler reflects request parameters into HTML output without applying context-aware encoding or a strict content security policy that would neutralize inline script injection.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges. The attacker crafts a URL pointing at the vulnerable google_gadget endpoint with a JavaScript payload embedded in a reflected parameter. The attacker then delivers the URL through phishing, chat, or a compromised third-party site. When the victim's browser loads the response, the payload executes and can read cookies not marked HttpOnly, exfiltrate CSRF tokens, submit authenticated requests, or redirect to attacker infrastructure.

No verified public proof-of-concept has been released. Refer to the Liferay CVE-2025-43735 Advisory for vendor-provided technical details.

Detection Methods for CVE-2025-43735

Indicators of Compromise

Web server access logs containing requests to google_gadget endpoints with URL-encoded <script>, javascript:, onerror=, or onload= payloads.
Referrer chains showing external sites directing users to Liferay google_gadget URLs carrying unusual query parameters.
Portal user reports of unexpected redirects, session logouts, or unfamiliar actions performed under their account.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect and block XSS payload patterns targeting Liferay portlet endpoints, particularly google_gadget.
Correlate outbound requests from user browsers to unfamiliar domains immediately after Liferay portal interactions.
Review Liferay audit logs for administrative actions initiated from unusual referrers or IP addresses following gadget-related requests.

Monitoring Recommendations

Enable verbose HTTP request logging on Liferay-facing reverse proxies and forward the logs to a centralized SIEM for pattern matching.
Alert on high-frequency access to google_gadget endpoints from single source IPs, which may indicate payload testing.
Monitor Content Security Policy (CSP) violation reports to identify blocked inline script executions consistent with reflected XSS attempts.

How to Mitigate CVE-2025-43735

Immediate Actions Required

Apply the Liferay security fix listed in the vendor advisory to all affected Portal 7.4 and DXP 2024.Q1 through 2024.Q4 instances.
Restrict access to the google_gadget endpoint at the reverse proxy or WAF until patches are applied.
Invalidate active portal sessions and force password resets if suspicious google_gadget requests are found in historical logs.

Patch Information

Liferay has published remediation guidance in the Liferay CVE-2025-43735 Advisory. Administrators running Liferay Portal 7.4.0 through 7.4.3.131 or Liferay DXP 2024.Q1 through 2024.Q4 branches should upgrade to the fixed release identified by the vendor for their branch.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce the impact of reflected XSS.
Configure WAF signatures to reject requests containing script tags, event handlers, or javascript: schemes in parameters processed by google_gadget.
Set the HttpOnly and Secure flags on Liferay session cookies to limit exposure of session identifiers to injected script.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on google_gadget requests
SecRule REQUEST_URI "@contains google_gadget" \
    "phase:2,deny,status:403,id:1004373,\
    msg:'Block potential CVE-2025-43735 XSS payload',\
    chain"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "t:none,t:urlDecodeUni"