CVE-2025-43742: Liferay DXP Reflected XSS Vulnerability

CVE-2025-43742 Overview

CVE-2025-43742 is a reflected cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw exists in the handling of friendly URLs for web content, allowing a remote unauthenticated attacker to inject JavaScript that executes in a victim's browser session. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.132, Liferay DXP 2024.Q1 through 2025.Q1 release lines, and Liferay DXP 7.4 GA through update 92. Exploitation requires only that a target user click a crafted link.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions within the Liferay application.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1.1–2024.Q1.14, 2024.Q2.0–2024.Q2.13, 2024.Q3.1–2024.Q3.13, 2024.Q4.0–2024.Q4.7, 2025.Q1.0–2025.Q1.3
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-08-20 - CVE-2025-43742 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43742

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the friendly URL processing logic used by Liferay's web content module. Friendly URLs are user-facing routing paths that map to internal content resources. Liferay reflects portions of these URL segments back into rendered pages without sufficient output encoding.

An attacker crafts a URL containing JavaScript payload characters within the friendly URL path or associated parameters. When a victim visits the malicious link, the server-generated response embeds the attacker-controlled content directly into the HTML document, and the browser executes it in the origin context of the Liferay site.

Because exploitation requires no authentication, the attack surface includes any publicly reachable Liferay instance serving web content through friendly URLs. Consequences include session cookie theft, forced actions against authenticated administrators, phishing overlays, and pivoting to internal portal APIs using the victim's credentials.

Root Cause

The root cause is missing or insufficient output encoding when reflecting friendly URL input into HTML responses. Liferay's content rendering path fails to apply contextual escaping to attacker-supplied URL data before inserting it into the DOM.

Attack Vector

The attack vector is network-based and requires user interaction with a crafted link, typically delivered via phishing email, chat message, or malicious referrer. No prior authentication or privileges on the Liferay instance are required. The malicious payload is embedded in the friendly URL path and reflected into the response served to the victim. Refer to the Liferay Security Advisory CVE-2025-43742 for vendor-provided technical details.

Detection Methods for CVE-2025-43742

Indicators of Compromise

HTTP request logs containing friendly URL paths with encoded script tags, javascript: schemes, or event handler attributes such as onerror= and onload=.
Requests to web content friendly URLs containing unusual character sequences like <, >, %3C, %3E, or document.cookie.
Referrer headers pointing to external phishing infrastructure directing users to Liferay endpoints.
Outbound browser traffic from user sessions to attacker-controlled domains immediately after visiting a Liferay page.

Detection Strategies

Deploy web application firewall (WAF) rules to inspect friendly URL segments for XSS payload patterns before they reach the Liferay backend.
Enable verbose access logging on Liferay's HTTP layer and parse logs for encoded script markers in URL paths.
Monitor Content Security Policy (CSP) violation reports for inline script executions originating from Liferay origins.

Monitoring Recommendations

Correlate URL access logs with user session activity to identify suspicious link-click patterns preceding session anomalies.
Alert on repeated 200-response requests to friendly URLs containing HTML metacharacters from a single source IP.
Track administrative user sessions for unexpected state-changing actions immediately following external referrer visits.

How to Mitigate CVE-2025-43742

Immediate Actions Required

Apply the patched Liferay Portal or DXP release from the vendor advisory to all production and staging instances.
Inventory all Liferay deployments and confirm version levels against the affected ranges.
Restrict internet exposure of non-production Liferay instances until patches are deployed.
Rotate session tokens and administrative credentials if suspicious friendly URL access is observed.

Patch Information

Liferay has published fixes and mitigation guidance in the Liferay Security Advisory CVE-2025-43742. Administrators should upgrade to a Liferay Portal 7.4 release later than 7.4.3.132, or to a Liferay DXP update that supersedes the affected quarterly release lines and update 92 of the 7.4 branch.

Workarounds

Deploy a WAF ruleset that blocks XSS metacharacters and encoded script payloads in friendly URL path segments.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on Liferay session cookies to reduce impact if payload execution occurs.
Educate portal administrators to avoid clicking untrusted links pointing to the Liferay domain until patching is complete.

bash

# Example WAF rule concept (ModSecurity) to block script markers in friendly URLs
SecRule REQUEST_URI "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1004374,phase:1,deny,status:403,msg:'Potential CVE-2025-43742 XSS payload in friendly URL'"