CVE-2025-43760: Liferay DXP Reflected XSS Vulnerability

CVE-2025-43760 Overview

CVE-2025-43760 is a reflected cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the PortalUtil.escapeRedirect method, which fails to properly sanitize user-supplied input. A remote authenticated attacker can inject JavaScript that executes in the context of a victim's browser session. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated attacker can inject arbitrary JavaScript through the PortalUtil.escapeRedirect sink, enabling session hijacking, credential theft, and unauthorized actions performed under a victim user's privileges.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132 and 7.4 GA through update 92
Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, and 2024.Q3.0 through 2024.Q3.13
Liferay DXP 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20

Discovery Timeline

2025-08-22 - CVE-2025-43760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43760

Vulnerability Analysis

The vulnerability exists in Liferay's PortalUtil.escapeRedirect method, a utility intended to sanitize redirect URL parameters before they are rendered back to the client. Insufficient encoding of specific input patterns allows attacker-controlled content to break out of the intended context. When a victim follows a crafted URL, the malicious payload is reflected into the response and executed by the browser.

Because the flaw requires authentication, exploitation typically targets logged-in portal users, administrators, or content authors. Successful injection runs with the full privileges of the victim session, enabling actions such as retrieving session cookies, submitting authenticated requests, or altering portal content.

Root Cause

The root cause is improper output neutralization in the escapeRedirect routine. The method does not consistently encode characters that carry meaning in an HTML or JavaScript execution context, allowing attacker-controlled data to be interpreted as script rather than data. This is a classic [CWE-79] reflected XSS pattern in a shared utility function used across multiple portal endpoints.

Attack Vector

The attack requires network access to the Liferay portal and valid authenticated credentials. An attacker crafts a URL containing a malicious redirect parameter that reaches the vulnerable PortalUtil.escapeRedirect sink. The victim, already authenticated to the portal, is lured into clicking the link through phishing or a same-site social engineering pretext. When the response renders, the injected JavaScript executes in the victim's origin, allowing the attacker to read document.cookie, issue authenticated XHR requests, or manipulate the DOM.

No verified proof-of-concept code is publicly available. Refer to the Liferay Security Advisory for CVE-2025-43760 for vendor technical detail.

Detection Methods for CVE-2025-43760

Indicators of Compromise

HTTP requests to Liferay endpoints containing redirect parameters with URL-encoded <script>, javascript:, onerror=, or onload= payloads.
Reflected response bodies that echo unusual characters such as <, >, or backticks originating from the redirect query parameter.
Outbound requests from authenticated sessions to unknown external hosts shortly after clicking a portal link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query and form parameters bound for Liferay for common XSS payload signatures.
Enable and review Liferay access logs for anomalous redirect parameter values, especially long strings or encoded HTML markup.
Correlate authenticated user sessions with subsequent unexpected API calls, privilege changes, or content modifications through your SIEM.

Monitoring Recommendations

Forward Liferay and reverse-proxy logs to a centralized logging platform and alert on suspicious redirect parameter values.
Monitor for unusual session activity such as rapid role changes, mass content edits, or exports triggered from a single user session.
Track browser Content Security Policy (CSP) violation reports to surface reflected script execution attempts.

How to Mitigate CVE-2025-43760

Immediate Actions Required

Inventory all Liferay Portal 7.4 and Liferay DXP deployments and identify versions within the affected ranges.
Apply the vendor-supplied fix documented in the Liferay Known Vulnerability advisory for CVE-2025-43760.
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources.
Review authenticated user accounts and rotate session tokens for administrative users after patching.

Patch Information

Liferay has published guidance and fixes for CVE-2025-43760 through its security portal. Upgrade Liferay Portal to a release beyond 7.4.3.132 or 7.4 GA update 92, and upgrade Liferay DXP to a fixed quarterly release above 2025.Q1.4. Consult the official Liferay advisory for the exact fix version applicable to your deployment channel.

Workarounds

Restrict portal access to trusted networks or VPN users while patching is scheduled.
Configure a WAF to block requests containing script tags, javascript: URIs, or HTML event handlers in redirect parameters.
Enforce short session timeouts and require re-authentication for privileged operations to limit the impact of hijacked sessions.
Enable HTTP security headers including Content-Security-Policy, X-Content-Type-Options: nosniff, and HttpOnly cookie flags.

bash

# Example nginx reverse proxy rule to block obvious XSS payloads in redirect params
location / {
    if ($arg_redirect ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://liferay_backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header X-Content-Type-Options "nosniff";
}