CVE-2025-43770: Liferay DXP Reflected XSS Vulnerability

CVE-2025-43770 Overview

CVE-2025-43770 is a reflected cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). Unauthenticated remote attackers can inject JavaScript into the referer or FORWARD_URL parameters by embedding a %00 (null byte) sequence. When a victim visits a crafted URL, the payload executes in the victim's browser under the Liferay origin.

The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation enables session theft, credential harvesting through fake login overlays, and unauthorized actions performed as the authenticated user.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browsers of authenticated Liferay users, enabling session hijacking and account takeover through crafted referer or FORWARD_URL parameters.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.131
Liferay DXP 7.4 GA through update 92
Liferay DXP 2024.Q1.1–Q1.12, 2024.Q2.0–Q2.13, 2024.Q3.1–Q3.13, 2024.Q4.0–Q4.3

Discovery Timeline

2025-08-23 - CVE-2025-43770 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43770

Vulnerability Analysis

The vulnerability resides in how Liferay handles the referer HTTP header and the FORWARD_URL request parameter. Both values are reflected back into rendered HTML responses without sufficient neutralization of active content. Attackers exploit this by supplying a URL that contains a null byte (%00) followed by JavaScript payload characters.

The null byte appears to bypass the input filter that would normally strip or encode dangerous characters. Downstream rendering logic still treats the remaining payload as valid markup, allowing script tags or event-handler attributes to reach the DOM. The attack requires no authentication and no elevated privileges, only a victim who visits or is redirected to a malicious link.

Because the payload executes in the origin of the Liferay instance, it inherits access to session cookies not marked HttpOnly, CSRF tokens embedded in the page, and any authenticated API endpoints reachable from the browser.

Root Cause

The root cause is inconsistent input sanitization between the filter that validates request parameters and the template layer that emits them into HTML. The null byte splits the validation logic's view of the input, letting the sanitizer approve a string whose latter half is still rendered verbatim. This is a classic filter-versus-renderer parser differential.

Attack Vector

Exploitation is remote, network-based, and requires user interaction. An attacker constructs a URL to a vulnerable Liferay endpoint that echoes the referer header or FORWARD_URL parameter. The attacker embeds %00 before the JavaScript payload. The victim clicks the link — for example from a phishing email or an attacker-controlled site — and the reflected script executes in the victim's session context.

No verified public exploit code is available for CVE-2025-43770. Consult the Liferay Security Advisory CVE-2025-43770 for vendor technical details.

Detection Methods for CVE-2025-43770

Indicators of Compromise

HTTP requests containing %00 in the Referer header or the FORWARD_URL query parameter
Reflected responses containing <script>, onerror=, or javascript: fragments in pages generated from Liferay portlets
Unexpected outbound requests from browser sessions immediately after users click Liferay URLs from external sources

Detection Strategies

Inspect web server and reverse proxy access logs for URI patterns containing encoded null bytes (%00) combined with HTML or script tokens
Deploy WAF signatures that flag Referer headers containing control characters or script delimiters targeting Liferay endpoints
Correlate authentication events with request patterns to identify session token reuse from unexpected IP addresses following a suspicious URL access

Monitoring Recommendations

Enable verbose HTTP request logging on Liferay front-end proxies, capturing full URLs, Referer headers, and response codes
Alert on any request where request parameters contain %00, \\x00, or raw null bytes
Monitor Liferay audit logs for sudden bursts of authenticated actions originating from a single user session within short time windows

How to Mitigate CVE-2025-43770

Immediate Actions Required

Upgrade Liferay Portal to version 7.4.3.132 or later and apply the corresponding DXP hotfix for the affected quarterly release
Restrict inbound traffic to Liferay administrative endpoints from untrusted networks pending patching
Configure a WAF rule to block requests containing %00 in the Referer header or FORWARD_URL parameter

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-43770. Administrators should apply the fix pack or upgrade to a patched quarterly release aligned with their subscription tier. Verify successful patch application by confirming the reported build number in the Liferay administrative console.

Workarounds

Add a reverse-proxy rule that rejects requests containing null bytes in headers or query strings before they reach Liferay
Set the Content-Security-Policy response header to disallow inline scripts, reducing the impact of reflected XSS payloads
Ensure session cookies use the HttpOnly and Secure flags so injected scripts cannot access them directly

bash

# Example NGINX rule to block null bytes in Referer header and query string
if ($http_referer ~* "%00|\\x00") {
    return 400;
}
if ($query_string ~* "FORWARD_URL=[^&]*(%00|\\x00)") {
    return 400;
}