CVE-2025-43800 Overview
CVE-2025-43800 is a stored cross-site scripting (XSS) vulnerability affecting the Objects feature in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows an authenticated remote attacker to inject arbitrary JavaScript or HTML through a crafted payload placed into an object with a rich text type field. When another user views the affected object, the injected script executes in the victim's browser session. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated attackers can execute arbitrary script in the context of other Liferay users, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.
Affected Products
- Liferay Portal 7.4.3.20 through 7.4.3.111
- Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4
- Liferay DXP 7.4 GA through update 92
Discovery Timeline
- 2025-09-15 - CVE-2025-43800 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43800
Vulnerability Analysis
The vulnerability resides in Liferay's Objects framework, specifically in how rich text type fields are rendered back to users. Rich text fields accept HTML markup by design to support formatted content such as bold text, lists, and links. When object records are displayed, the stored content is embedded into the response page.
Because the field content is not sufficiently neutralized before rendering, an attacker can supply markup that includes <script> tags, event handlers, or other executable HTML constructs. Any user who views the object will trigger execution of the attacker-controlled script in the context of the Liferay origin.
Exploitation requires authentication with permission to create or edit an object, plus victim interaction such as viewing the affected object. The impact is limited to the browser session of the victim, but this can extend to administrative accounts if they interact with attacker-controlled records.
Root Cause
The root cause is improper output encoding of rich text field content when object data is rendered. Liferay's rich text handling permits HTML input but fails to strip or escape script-bearing constructs on output, violating the neutralization requirements described in CWE-79.
Attack Vector
An attacker with low-privileged access authenticates to the Liferay portal and creates or modifies an object that contains a rich text field. The attacker embeds a crafted payload — for example, an HTML tag carrying a JavaScript event handler — into the rich text field. When another authenticated user, potentially an administrator, opens the record, the browser parses the embedded HTML and executes the injected script.
// Example payload class (sanitized, illustrative only)
// Injected into a rich text Object field:
// <img src=x onerror="/* attacker JavaScript */">
// See the Liferay advisory for authoritative technical details.
Detection Methods for CVE-2025-43800
Indicators of Compromise
- Object records containing HTML tags such as <script>, <iframe>, or event-handler attributes (onerror, onload, onmouseover) inside rich text fields.
- Unexpected outbound requests from Liferay user browsers to attacker-controlled domains shortly after viewing object pages.
- Session token or authentication cookie exfiltration observed in web proxy logs originating from Liferay portal sessions.
Detection Strategies
- Review Liferay audit logs for object creation and edit events that include rich text field content matching XSS signatures.
- Query the underlying database for object records containing <script, javascript:, or on[a-z]+= patterns in rich text columns.
- Deploy web application firewall (WAF) rules that inspect POST bodies to /o/object-admin/ and related Objects API endpoints for script-bearing payloads.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to surface injected inline scripts executing on Liferay pages.
- Monitor privileged account activity for anomalous administrative actions immediately after viewing user-generated object content.
- Alert on repeated edits to the same object rich text field by low-privileged users, which may indicate payload tuning.
How to Mitigate CVE-2025-43800
Immediate Actions Required
- Upgrade Liferay Portal to a release beyond 7.4.3.111 and Liferay DXP to a version that includes the fix per the Liferay CVE-2025-43800 advisory.
- Audit existing object definitions that use rich text fields and review stored records for injected markup.
- Restrict permissions to create and edit objects to trusted users until patches are applied.
Patch Information
Liferay has published fix guidance in the vendor advisory. Refer to the Liferay CVE-2025-43800 Vulnerability Details for the authoritative list of fixed versions and required service pack levels for DXP customers.
Workarounds
- Disable or remove rich text field types from object definitions where formatted input is not required, and use plain text fields instead.
- Deploy a strict Content Security Policy that blocks inline script execution to reduce the impact of stored XSS payloads.
- Apply WAF signatures to reject requests to Objects API endpoints that contain <script> tags or JavaScript event-handler attributes.
# Example CSP header to reduce stored XSS impact on Liferay responses
# Add to reverse proxy or Liferay portal-ext.properties web server config
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
