CVE-2025-43802: Liferay DXP Stored XSS Vulnerability

CVE-2025-43802 Overview

CVE-2025-43802 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the custom object /o/c/<object-name> API endpoint in Liferay Portal and Liferay Digital Experience Platform (DXP). Authenticated remote attackers can inject arbitrary web script or HTML through the externalReferenceCode parameter. The payload persists in the backend and executes in the browsers of other users who view the affected object, enabling session theft, credential capture through fake login prompts, or unauthorized actions performed in the victim's session.

Critical Impact
Stored XSS allows persistent script injection in Liferay's custom object API, enabling attacks against any authenticated user who loads the poisoned object data.

Affected Products

Liferay Portal 7.4.3.51 through 7.4.3.109
Liferay DXP 2023.Q3.1 through 2023.Q3.4 and 7.4 update 51 through update 92
Liferay DXP 7.3 update 33 through update 35

Discovery Timeline

2025-09-15 - CVE-2025-43802 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43802

Vulnerability Analysis

Liferay's headless object framework exposes custom objects through the /o/c/<object-name> REST endpoint. Each object record accepts an externalReferenceCode field intended as a stable identifier for integration scenarios. The endpoint fails to sanitize or encode HTML-significant characters before storing the value or rendering it back to consumers. As a result, script content submitted through this parameter is retained in the persistence layer and later delivered verbatim to any client that reads the object.

Because the injection lives on the server, exploitation does not require phishing links or crafted URLs. Any authenticated user with permission to access the affected custom object will trigger the payload when the portal or a downstream application renders the field in an HTML context.

Root Cause

The root cause is missing output encoding and input validation on the externalReferenceCode parameter within the custom object API path. Liferay's standard XSS filtering pipeline is not applied to this field, allowing markup such as <script>, <img onerror=...>, or event-handler attributes to pass through unchanged.

Attack Vector

Exploitation requires network access to the Liferay instance and low-privileged authenticated access sufficient to create or update a custom object record. The attacker submits a POST or PATCH request to /o/c/<object-name> with a malicious value in externalReferenceCode. Victim interaction is required — a user must load a view that renders the tainted field. Payloads execute in the security context of the Liferay portal origin, granting access to session cookies not protected by HttpOnly, DOM data, and portal APIs authorized for the victim.

No public proof-of-concept or exploit code has been published at this time. Refer to the Liferay Security Advisory CVE-2025-43802 for authoritative technical details.

Detection Methods for CVE-2025-43802

Indicators of Compromise

HTTP POST or PATCH requests to /o/c/<object-name> containing <, >, script, onerror, onload, or URL-encoded equivalents in the externalReferenceCode field.
Stored custom object records where externalReferenceCode contains HTML tags, JavaScript URI schemes, or event-handler attributes rather than a plain identifier string.
Unexpected outbound requests from browsers of Liferay users to attacker-controlled domains shortly after loading custom object views.

Detection Strategies

Inspect Liferay access logs and reverse-proxy logs for API calls to /o/c/ endpoints with suspicious payloads in the request body.
Run a database query against the custom object tables to identify existing externalReferenceCode values containing markup or non-ASCII control sequences.
Deploy Content Security Policy (CSP) reporting to surface script-source violations that indicate injected payloads executing.

Monitoring Recommendations

Enable verbose logging on Liferay headless API endpoints and forward events to a centralized analytics platform for correlation.
Alert on anomalous write activity to custom object endpoints from accounts that do not normally perform integration tasks.
Track user-agent and geolocation patterns for accounts creating or updating custom objects to identify credential misuse.

How to Mitigate CVE-2025-43802

Immediate Actions Required

Apply the fixed release from Liferay for your version branch by consulting the Liferay Security Advisory CVE-2025-43802.
Audit existing custom object records and sanitize any externalReferenceCode values that contain HTML or scripting content.
Review role assignments to reduce the number of accounts able to create or modify custom objects to the minimum required.

Patch Information

Liferay has published a security advisory for CVE-2025-43802 with remediation guidance. Upgrade Liferay Portal to a release above 7.4.3.109, Liferay DXP 2023.Q3 to a release above 2023.Q3.4, Liferay DXP 7.4 to a release above update 92, and Liferay DXP 7.3 to a release above update 35. Consult the vendor advisory for the exact fix version aligned to your deployment.

Workarounds

Place a web application firewall (WAF) rule in front of Liferay that blocks HTML metacharacters and common XSS payloads in the externalReferenceCode parameter of /o/c/ requests.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to limit payload execution.
Set the HttpOnly and Secure attributes on Liferay session cookies to reduce the impact of script execution on session integrity.

bash

# Example WAF rule (ModSecurity) to block markup in externalReferenceCode
SecRule REQUEST_URI "@beginsWith /o/c/" \
    "chain,phase:2,deny,status:403,id:1004380,log,msg:'Potential CVE-2025-43802 XSS payload'"
    SecRule ARGS:externalReferenceCode "@rx (?i)(<[a-z!/]|javascript:|on[a-z]+\s*=)" "t:urlDecodeUni"