CVE-2025-43815: Liferay DXP Reflected XSS Vulnerability

CVE-2025-43815 Overview

CVE-2025-43815 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting the page configuration page in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw exists in the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter, which fails to sanitize user-supplied input before rendering it in the response. Remote attackers can inject arbitrary web script or HTML through a crafted URL. Successful exploitation requires an authenticated victim to interact with the malicious link, typically an administrator with access to the page configuration interface.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated Liferay user, enabling session theft, administrative action hijacking, and content manipulation within the portal.

Affected Products

Liferay Portal 7.4.3.102 through 7.4.3.110
Liferay DXP 2023.Q4.0 through 2023.Q4.2
Liferay DXP 2023.Q3.5

Discovery Timeline

2025-09-29 - CVE-2025-43815 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43815

Vulnerability Analysis

The vulnerability resides in the Layout Admin portlet used to manage site pages within Liferay. The backURLTitle parameter accepts user-controlled input intended to display a label for a return navigation link. The application reflects this value into the rendered HTML response without proper output encoding or contextual escaping. An attacker who crafts a URL containing script payloads in this parameter can cause the browser to execute the injected code when a victim loads the page.

Because the injection point sits within the authenticated administrative interface, exploitation impacts users with elevated privileges. This context expands the practical severity beyond a typical reflected XSS against anonymous browsers.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Liferay's Layout Admin web module does not apply HTML entity encoding to the backURLTitle request parameter prior to inserting it into the DOM. Any characters with syntactic meaning in HTML or JavaScript contexts—such as <, >, ", and '—pass through unchanged.

Attack Vector

Exploitation requires network access to the Liferay instance and user interaction. An attacker crafts a URL targeting the GroupPagesPortlet endpoint with a malicious backURLTitle payload. The attacker delivers this URL through phishing, malicious links embedded in trusted communications, or cross-site link injection. When a signed-in Liferay user clicks the link, the injected JavaScript executes in their session context.

The injected script can read session cookies not marked HttpOnly, issue authenticated API calls, modify page configurations, or exfiltrate data visible to the compromised user.

Refer to the Liferay Security Advisory CVE-2025-43815 for vendor-provided technical details.

Detection Methods for CVE-2025-43815

Indicators of Compromise

Web server or reverse proxy logs containing requests to com_liferay_layout_admin_web_portlet_GroupPagesPortlet with suspicious backURLTitle parameter values that include <script>, javascript:, onerror=, or URL-encoded equivalents.
Referer headers pointing to external or untrusted domains preceding administrative Liferay requests.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled infrastructure shortly after page configuration access.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the backURLTitle parameter for HTML tags, event handlers, and script schemes.
Enable and review Liferay audit logs for anomalous administrative activity following access to /group/*/~/control_panel/manage.
Correlate authenticated portal sessions with unusual client-side activity such as rapid successive API calls originating from a single admin session.

Monitoring Recommendations

Instrument Content Security Policy (CSP) violation reporting to capture blocked inline script execution attempts.
Monitor for phishing campaigns referencing Liferay administrative URLs targeting portal administrators.
Alert on inbound requests containing URL-encoded angle brackets (%3C, %3E) in Liferay portlet parameters.

How to Mitigate CVE-2025-43815

Immediate Actions Required

Upgrade Liferay Portal to a version later than 7.4.3.110 and Liferay DXP to the fixed release identified in the vendor advisory.
Restrict administrative access to Liferay portlets to trusted network segments and enforce multi-factor authentication for privileged accounts.
Communicate phishing awareness guidance to portal administrators, emphasizing scrutiny of unsolicited links referencing internal Liferay URLs.

Patch Information

Liferay has published remediation details in the Liferay Security Advisory CVE-2025-43815. Apply the patched Portal or DXP release corresponding to your deployment channel. Subscribers to Liferay DXP should consult the vendor portal for the applicable hotfix package.

Workarounds

Deploy WAF rules to strip or reject backURLTitle parameter values containing HTML metacharacters until patching is complete.
Enforce a strict Content Security Policy that disallows inline script execution (script-src 'self') on Liferay administrative pages.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of client-side script execution.

bash

# Example nginx rule to block script-like payloads in the vulnerable parameter
if ($arg_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle ~* "(<|%3C)(script|iframe|img|svg)") {
    return 403;
}