CVE-2025-43811: Liferay DXP Stored XSS Vulnerability

CVE-2025-43811 Overview

CVE-2025-43811 is a stored cross-site scripting (XSS) vulnerability affecting the related asset selector component in Liferay Portal and Liferay Digital Experience Platform (DXP). Authenticated attackers can inject arbitrary HTML or JavaScript into an asset author's First Name, Middle Name, or Last Name text fields. The payload persists in the backend and executes in the browser of any user who renders the related asset selector.

The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated attackers can execute arbitrary script in the context of other Liferay users, enabling session theft, account takeover, and unauthorized actions within the portal.

Affected Products

• Liferay Portal 7.4.3.50 through 7.4.3.111
• Liferay DXP 2023.Q4.0 through 2023.Q4.4, and 2023.Q3.1 through 2023.Q3.7
• Liferay DXP 7.4update 50 through update 92

Discovery Timeline

• 2025-09-29 - CVE-2025-43811 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43811

Vulnerability Analysis

The flaw resides in the related asset selector, a portal component that lets editors browse and attach related content items. When the selector renders results, it displays the author of each asset by concatenating the author's First Name, Middle Name, and Last Name fields into the output markup.

These name fields are stored as user profile attributes and are rendered without adequate output encoding. Any HTML or JavaScript placed inside those fields is emitted verbatim into the response, producing a stored XSS condition.

Exploitation requires only low-privileged authenticated access to set the malicious profile values, plus user interaction from a victim who opens the related asset selector. The impact is bounded by the browser session of the victim: attackers can hijack sessions, perform actions on behalf of higher-privileged users, or pivot to administrative functions if an administrator triggers the payload.

Root Cause

The root cause is missing contextual output encoding when user-supplied profile name fields are rendered inside the related asset selector view. The application trusts profile metadata that should be treated as untrusted input under CWE-79.

Attack Vector

An authenticated attacker updates their own profile — or another writable user profile — placing an HTML or JavaScript payload into First Name, Middle Name, or Last Name. The attacker then creates or edits an asset so their profile is surfaced when another user browses related assets. When the victim opens the related asset selector, the payload executes in their browser under the Liferay origin.

Refer to the Liferay CVE-2025-43811 Vulnerability advisory for vendor-supplied details.

Detection Methods for CVE-2025-43811

Indicators of Compromise

• User profile records where firstName, middleName, or lastName contain HTML control characters such as <, >, ", ', or substrings like <script, onerror=, or javascript:.
• Web server access logs showing profile update requests (/api/jsonws/user* or portlet edit actions) followed by asset creation events from the same account.
• Unexpected outbound requests from browsers of editors and administrators shortly after opening the related asset selector.

Detection Strategies

• Query the Liferay User_ table for name columns containing angle brackets, encoded script tags, or event-handler attributes.
• Deploy web application firewall (WAF) rules that inspect profile update endpoints for HTML/JavaScript patterns in name fields.
• Correlate authenticated profile edits with subsequent asset publishing activity to surface accounts staging stored XSS payloads.

Monitoring Recommendations

• Enable Liferay audit logging for user profile modifications and asset publishing actions.
• Forward portal application and access logs to a centralized analytics platform for retention and anomaly detection.
• Alert on Content Security Policy (CSP) violation reports originating from portal pages that host the related asset selector.

How to Mitigate CVE-2025-43811

Immediate Actions Required

• Apply the Liferay fixed release for your branch as identified in the vendor advisory.
• Audit existing user profiles and sanitize any First Name, Middle Name, or Last Name values that contain HTML or script content.
• Restrict self-service profile edits and content authoring permissions to trusted accounts until patching is complete.

Patch Information

Liferay has published fixes for affected Portal and DXP branches. Upgrade Liferay Portal beyond 7.4.3.111, Liferay DXP 2023.Q4 beyond 2023.Q4.4, Liferay DXP 2023.Q3 beyond 2023.Q3.7, and Liferay DXP 7.4 beyond update 92. Consult the vendor advisory for the exact target version for your deployment channel.

Workarounds

• Enforce a strict Content Security Policy that blocks inline scripts (script-src 'self') on portal pages that render the related asset selector.
• Add server-side or WAF-based validation rejecting HTML metacharacters in profile name fields.
• Temporarily revoke content authoring permissions from low-trust user roles until the patch is deployed.

# Example CSP response header hardening for Liferay (nginx reverse proxy)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;