CVE-2025-43794: Liferay DXP Stored XSS Vulnerability

CVE-2025-43794 Overview

CVE-2025-43794 is a stored cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Instance Configuration screen, where the CDN Host HTTP and CDN Host HTTPS text fields fail to sanitize user-supplied input. A remote authenticated attacker holding the instance administrator role can inject arbitrary HTML or JavaScript that executes on every page rendered by the portal. The stored nature of the payload amplifies impact, since the injected script fires in the browser context of every user visiting the instance, including other administrators.

Critical Impact
A malicious instance administrator can persist JavaScript across all portal pages, enabling session theft, credential harvesting, and administrative action forgery against every visitor. [CWE-79]

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions
Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4
Liferay DXP 7.4 GA through update 92 and 7.3 GA through update 35

Discovery Timeline

2025-09-15 - CVE-2025-43794 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43794

Vulnerability Analysis

The vulnerability is a stored XSS classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Liferay renders the values configured in the Instance Configuration's Content Delivery Network (CDN) host fields directly into HTML output on every portal page. Because these values are used to build resource URLs in the page markup, the framework treats them as trusted configuration data rather than user input, bypassing normal output encoding paths.

Exploitation requires an authenticated account with the instance administrator role, which limits the attacker population but not the blast radius. Once injected, the payload is served to every user who loads any page in the affected instance. Attackers can steal session cookies, pivot to admin-only endpoints via forged requests, or deliver browser-based malware to authenticated staff.

Root Cause

The root cause is missing or insufficient output encoding of the CDN Host HTTP and CDN Host HTTPS configuration values before they are embedded in generated HTML. Liferay assumed these fields would contain only host names, but the input validator did not enforce a strict hostname grammar, allowing angle brackets, quotes, and JavaScript URI schemes to pass through and reach the DOM as executable markup.

Attack Vector

An authenticated attacker with the instance administrator role navigates to the Instance Configuration panel, opens the CDN section, and submits a crafted payload in the HTTP or HTTPS CDN host field. Liferay persists the string in the configuration store. On subsequent page renders across the entire instance, the portal emits the tainted value into <link>, <script>, or similar tags. The browser parses the resulting markup and executes the attacker's JavaScript in the origin of the portal, exposing all authenticated sessions to the injected code. No verified public proof-of-concept exploit has been published.

No verified proof-of-concept code is available for CVE-2025-43794.
Refer to the Liferay security advisory for technical details:
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43794

Detection Methods for CVE-2025-43794

Indicators of Compromise

CDN host configuration values containing characters outside a valid hostname grammar, such as <, >, ", ', backticks, or the substrings javascript:, onerror=, or <script.
Portal audit-log entries showing modifications to Instance Configuration CDN settings by administrator accounts, especially outside normal change windows.
Outbound browser requests from authenticated portal sessions to unfamiliar domains referenced in <script src> tags served from Liferay pages.

Detection Strategies

Review the current values of CDN Host HTTP and CDN Host HTTPS across every Liferay instance and virtual instance; valid values should match a strict hostname regex such as ^[A-Za-z0-9.\-]+$.
Search web server access and proxy logs for anomalous Referer values or embedded resource URLs whose hostnames do not resolve to legitimate CDN endpoints.
Correlate administrator authentication events with subsequent configuration changes to identify unauthorized use of the instance administrator role.

Monitoring Recommendations

Alert on any change to Liferay Instance Configuration CDN fields and require a secondary approval workflow for configuration writes.
Deploy Content Security Policy (CSP) headers in report-only mode initially, then enforcing mode, to surface inline-script violations that indicate injected payloads.
Monitor authenticated user sessions for anomalous JavaScript-driven API calls to Liferay administrative endpoints such as /api/jsonws/.

How to Mitigate CVE-2025-43794

Immediate Actions Required

Audit both CDN host fields on every Liferay Portal and DXP instance and replace any non-hostname value with a validated CDN domain or leave the fields blank.
Apply the fix pack or quarterly release referenced in the Liferay security advisory for your branch (Portal 7.4 or DXP 7.3/7.4/2023.Q3/2023.Q4).
Reduce the number of accounts assigned the instance administrator role and require multi-factor authentication on all remaining accounts.

Patch Information

Liferay has published fixes and remediation guidance in the vendor advisory. Consult the Liferay CVE-2025-43794 Vulnerability advisory for the specific fix pack, service pack, or DXP update that addresses your deployment. Customers on unsupported branches should upgrade to a supported release, since backports are not provided for legacy versions.

Workarounds

Restrict access to the Instance Configuration UI at the network layer to a management VLAN or bastion host, limiting exposure of the vulnerable form.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to a known allowlist to blunt payload execution.
Remove the instance administrator role from any account that does not require it and rotate credentials for accounts that recently held the role.

bash

# Example CSP header to reduce stored-XSS impact in Liferay reverse proxy (NGINX)
add_header Content-Security-Policy "default-src 'self'; \
    script-src 'self' https://trusted-cdn.example.com; \
    style-src 'self' 'unsafe-inline'; \
    object-src 'none'; \
    base-uri 'self'; \
    frame-ancestors 'self'" always;