CVE-2025-43804: Liferay DXP Search Widget XSS Vulnerability

CVE-2025-43804 Overview

CVE-2025-43804 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the Search widget of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw affects Liferay Portal versions 7.4.3.93 through 7.4.3.111, Liferay DXP 2023.Q4.0, and DXP 2023.Q3.1 through 2023.Q3.4. Remote attackers can inject arbitrary web script or HTML through the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter. Successful exploitation requires user interaction, such as clicking a crafted link. The vulnerability has an EPSS probability of 0.216%, indicating low observed exploitation likelihood at this time.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or unauthorized actions within the Liferay portal.

Affected Products

Liferay Portal 7.4.3.93 through 7.4.3.111
Liferay DXP 2023.Q4.0
Liferay DXP 2023.Q3.1 through 2023.Q3.4

Discovery Timeline

2025-09-16 - CVE-2025-43804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43804

Vulnerability Analysis

The vulnerability resides in the Search widget component of Liferay Portal and DXP. The Search portlet accepts a userId request parameter, exposed as _com_liferay_portal_search_web_portlet_SearchPortlet_userId, and reflects its value into the rendered page without adequate output encoding. This behavior allows attacker-controlled input to break out of its intended context and execute as script in the browser.

Because the vulnerable parameter is processed on standard search request paths, exploitation does not require authentication. An attacker delivers a crafted URL to a target user, and the payload executes under the origin of the Liferay portal. This enables theft of session cookies, forged administrative actions, and phishing pivots within trusted portal pages.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. The Search portlet fails to sanitize or HTML-encode the userId parameter before including it in server responses. Any characters with syntactic meaning in HTML or JavaScript contexts are rendered verbatim to the client.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL to a vulnerable Liferay Portal instance containing a malicious payload in the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter. When a victim visits the link, the injected script executes in the browser under the portal's origin, inheriting the victim's session context.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Liferay Security Advisory CVE-2025-43804 for vendor technical details.

Detection Methods for CVE-2025-43804

Indicators of Compromise

HTTP request logs containing the parameter _com_liferay_portal_search_web_portlet_SearchPortlet_userId with values including <, >, script, onerror, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers pointing to external or untrusted domains preceding requests to the Liferay Search portlet.
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after portal access.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters targeting SearchPortlet_userId for HTML tag characters and known XSS payload patterns.
Review Liferay access logs for reflected content in the userId parameter and correlate with user session activity.
Monitor for suspicious client-side script execution and cookie exfiltration attempts through browser telemetry and endpoint DNS logs.

Monitoring Recommendations

Enable verbose logging on the Liferay Portal search subsystem and ingest logs into a centralized SIEM for parameter inspection.
Alert on high-volume clicks to Liferay search URLs originating from external referrers, especially from email or messaging platforms.
Track administrative account activity for anomalous session behavior that could indicate session hijacking following an XSS payload delivery.

How to Mitigate CVE-2025-43804

Immediate Actions Required

Upgrade Liferay Portal to a fixed release beyond 7.4.3.111 and Liferay DXP to a version that addresses this advisory.
Apply the patch or fix pack referenced in the Liferay Security Advisory CVE-2025-43804.
Audit portal pages that embed the Search widget and restrict exposure of the widget on unauthenticated pages where feasible.

Patch Information

Liferay has published remediation guidance in the vendor security advisory. Administrators should consult the Liferay Security Advisory CVE-2025-43804 for specific fix pack, service pack, and quarterly release versions that contain the patch.

Workarounds

Configure a WAF or reverse proxy to reject requests containing HTML metacharacters in the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce the impact of reflected XSS payloads.
Educate users to avoid clicking untrusted links referencing the corporate Liferay portal until patches are applied.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in the vulnerable parameter
SecRule ARGS:_com_liferay_portal_search_web_portlet_SearchPortlet_userId \
  "@rx (?i)(<script|onerror=|javascript:|<img|%3Cscript)" \
  "id:1004380,phase:2,deny,status:403,log,msg:'CVE-2025-43804 XSS attempt blocked'"