CVE-2025-43785: Liferay DXP Stored XSS Vulnerability

CVE-2025-43785 Overview

CVE-2025-43785 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the My Workflow Tasks page, where user-supplied input is rendered without adequate output encoding. A remote authenticated attacker with high privileges can inject arbitrary HTML or JavaScript that executes in the browsers of other users who view the affected page. Successful exploitation can lead to session context abuse, unauthorized actions in the portal, or content manipulation within the victim's browser.

Critical Impact
Attackers with elevated portal privileges can persistently store malicious scripts that execute against other Liferay users, enabling limited confidentiality and integrity impact on their sessions.

Affected Products

Liferay Portal 7.4.3.45 through 7.4.3.128
Liferay DXP 2024.Q2.0 through 2024.Q2.9 and 2024.Q1.1 through 2024.Q1.12
Liferay DXP 7.4 update 45 through update 92

Discovery Timeline

2025-09-10 - CVE-2025-43785 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43785

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the My Workflow Tasks view of Liferay Portal and Liferay DXP. Workflow task metadata handled by this page is persisted server-side and later rendered to authorized users. Because the rendering layer does not consistently HTML-encode this content, an attacker who can influence workflow-related fields can plant an executable payload.

When a legitimate user opens the My Workflow Tasks page, the payload is returned as part of the HTML response and executes within the same origin as the Liferay application. This grants the payload access to the victim's cookies (where not marked HttpOnly), CSRF tokens, and any authenticated portlet actions the user is permitted to perform.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. Data flowing into the My Workflow Tasks view is stored in workflow task attributes and later emitted to the DOM without sufficient contextual encoding. Liferay's taglib and template layer should escape special characters such as <, >, ", and ', but this specific rendering path fails to do so.

Attack Vector

Exploitation requires network access to the portal and an authenticated account with high privileges to seed workflow task content. The attacker submits a task field containing an HTML or JavaScript payload. The payload is stored by the workflow engine and rendered to any subsequent user who visits the My Workflow Tasks page. User interaction is required to trigger the script in the victim's browser.

No verified proof-of-concept code has been published. Refer to the Liferay Security Advisory CVE-2025-43785 for vendor technical details.

Detection Methods for CVE-2025-43785

Indicators of Compromise

Workflow task fields containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> stored in the Liferay database.
Outbound requests from user browsers to unexpected external domains immediately after visiting /group/control_panel/manage?p_p_id=com_liferay_portal_workflow_task_web_....
HTTP responses from the My Workflow Tasks portlet containing unescaped markup in task title, description, or asset fields.

Detection Strategies

Inspect workflow task records for stored values containing angle brackets, JavaScript event handlers (onerror, onload, onclick), or javascript: URIs.
Enable and review Liferay audit logs for workflow task creation and update events performed by privileged accounts.
Deploy a web application firewall rule that flags workflow task submissions containing script-like tokens.

Monitoring Recommendations

Alert on anomalous privileged user activity that creates or modifies large numbers of workflow tasks in short intervals.
Monitor Content Security Policy (CSP) violation reports from the Liferay origin for inline script executions.
Correlate browser telemetry from portal users with server-side workflow modification events to identify payload delivery.

How to Mitigate CVE-2025-43785

Immediate Actions Required

Upgrade Liferay Portal to a release later than 7.4.3.128, and Liferay DXP to a fixed 2024.Q2, 2024.Q1, or 7.4 update per vendor guidance.
Audit high-privilege portal accounts and rotate credentials for any account suspected of misuse.
Review existing workflow task content for stored HTML or script payloads and sanitize affected records.

Patch Information

Liferay has released fixes as documented in the Liferay Security Advisory CVE-2025-43785. Customers on Liferay DXP should apply the latest available update within their supported release branch (2024.Q2, 2024.Q1, or 7.4). Liferay Portal Community Edition users should upgrade beyond 7.4.3.128.

Workarounds

Restrict workflow administration and task creation permissions to a minimal set of trusted administrators until patching is complete.
Deploy a strict Content Security Policy that disallows inline scripts (script-src 'self') to blunt exploitation impact.
Configure a WAF policy to reject workflow-related POST bodies containing HTML tags or JavaScript event handler attributes.

bash

# Configuration example
# Example CSP header to mitigate stored XSS impact in Liferay
# Add to your reverse proxy (e.g., NGINX) fronting Liferay
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;