CVE-2025-43744: Liferay DXP Stored XSS Vulnerability

CVE-2025-43744 Overview

CVE-2025-43744 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Asset Publisher configuration UI, specifically within the Source.js module. Attackers with authenticated access can inject arbitrary JavaScript through Dynamic Data Mapping (DDM) structure field labels. These labels are subsequently inserted into the Document Object Model (DOM) using innerHTML without proper output encoding, resulting in script execution in the context of other users who view the configuration UI.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browsers of administrators or other users interacting with the Asset Publisher configuration UI, enabling session theft, unauthorized actions, and content tampering within the Liferay portal.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132 (including 7.4 GA through update 92)
Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.1 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7
Liferay DXP 2025.Q1.0 through 2025.Q1.15 and 2025.Q2.0 through 2025.Q2.5

Discovery Timeline

2025-08-19 - CVE-2025-43744 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43744

Vulnerability Analysis

The vulnerability is a stored DOM-based XSS issue classified under [CWE-79]. It affects the Asset Publisher portlet's configuration interface, a widely used component in Liferay for aggregating and displaying site content. The attack vector is network-based, requires low privileges, and requires user interaction (a victim must view the affected UI). Successful exploitation compromises the confidentiality and integrity of both the vulnerable component and adjacent components within the same portal session.

Because the payload is stored server-side within DDM structure field labels and rendered client-side, exploitation persists across sessions. Any authorized user with permission to define or edit DDM structure fields can plant a payload that later fires in the browsers of privileged users who administer Asset Publisher instances.

Root Cause

The root cause lies in the Source.js module of the Asset Publisher configuration UI. The module uses the innerHTML property to insert DDM structure field label values into the DOM without applying HTML encoding or sanitization. Because innerHTML parses assigned strings as HTML, any embedded <script> tags or event handler attributes (for example, onerror, onload) become active markup and execute in the user's browser.

Attack Vector

An authenticated attacker with permission to create or modify DDM structures crafts a field label that contains malicious HTML or JavaScript. The label is persisted in Liferay's data store. When an administrator or other user opens the Asset Publisher configuration interface referencing that structure, the client-side Source.js code renders the label through innerHTML, triggering the injected payload. The payload executes with the victim's session privileges and can perform actions such as exfiltrating session cookies, issuing authenticated requests, or modifying portal content.

No verified public proof-of-concept exploit code is available. Refer to the Liferay Security Advisory CVE-2025-43744 for vendor-provided technical details.

Detection Methods for CVE-2025-43744

Indicators of Compromise

DDM structure field labels containing HTML tags, angle brackets, or JavaScript syntax such as <script>, onerror=, or javascript: schemes.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after opening the Asset Publisher configuration UI.
Audit log entries showing DDM structure modifications by low-privilege accounts followed by administrator access to the Asset Publisher.

Detection Strategies

Scan the Liferay database for DDM structure field label values containing markup characters or JavaScript keywords.
Enable Content Security Policy (CSP) reporting to capture inline-script violations that indicate stored payload execution.
Correlate portal audit logs of structure edits with subsequent administrator sessions accessing the Asset Publisher configuration.

Monitoring Recommendations

Monitor Liferay application logs for anomalous access patterns to /o/portlet_configuration and Asset Publisher endpoints.
Alert on session anomalies affecting privileged administrator accounts following interaction with content management features.
Track HTTP responses served from the portal for unexpected <script> content within DDM-rendered fragments.

How to Mitigate CVE-2025-43744

Immediate Actions Required

Upgrade Liferay Portal to a version beyond 7.4.3.132 and apply the corresponding DXP quarterly release fixes as documented in the vendor advisory.
Audit existing DDM structures for field labels containing HTML or script content and sanitize or delete suspicious entries.
Review the permission model to ensure only trusted roles can create or modify DDM structures.

Patch Information

Liferay has published fix guidance in the Liferay Security Advisory CVE-2025-43744. Administrators of Liferay DXP should apply the latest quarterly service pack for their release stream (2024.Q1 through 2025.Q2). Liferay Portal Community Edition users should move to a release later than 7.4.3.132 or 7.4 update 92.

Workarounds

Restrict DDM structure creation and modification privileges to a minimal set of trusted administrators until patches are deployed.
Deploy a strict Content Security Policy that disallows inline scripts, reducing the impact of injected payloads within the Asset Publisher UI.
Temporarily disable or hide the Asset Publisher configuration UI for non-essential administrators in shared environments.

bash

# Example Content Security Policy header to mitigate inline script execution
# Add to the web server or reverse proxy fronting Liferay
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';";