CVE-2025-43824: Liferay DXP Profile Widget XSS Vulnerability

CVE-2025-43824 Overview

CVE-2025-43824 affects the Profile widget in Liferay Portal and Liferay Digital Experience Platform (DXP). The widget places a user's name directly into the Content-Disposition HTTP header when serving vCard downloads. An authenticated user can manipulate their profile name to change the file extension of the downloaded vCard. The flaw is classified under [CWE-79] and impacts multiple supported and unsupported release branches of Liferay Portal 7.4.x and DXP 2023.Q3/Q4 and 7.4 GA.

Critical Impact
Authenticated attackers can influence the filename and extension of vCard downloads served by the Profile widget, enabling social engineering and potential client-side content handling abuse.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions
Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
Liferay DXP 7.4 GA through update 92, and older unsupported versions

Discovery Timeline

2025-10-06 - CVE-2025-43824 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43824

Vulnerability Analysis

The Profile widget generates a vCard download response and inserts the user's display name into the Content-Disposition header as the filename value. Because the user-controlled string is not sanitized or constrained, an authenticated user can craft a display name that alters the served filename, including its extension. Downstream clients rely on this header to decide how to store or open the file. The vulnerability is tracked under [CWE-79], reflecting improper neutralization of user input placed into a response context.

Root Cause

The root cause is a lack of output encoding and filename validation on the user-supplied name before it is concatenated into the Content-Disposition: attachment; filename="..." header. Liferay does not enforce a .vcf extension or strip characters such as quotation marks, semicolons, or additional file extensions. As a result, the header value reflects attacker-controlled content verbatim.

Attack Vector

Exploitation requires an authenticated Liferay account with permission to edit profile fields. The attacker sets a name that embeds a filename and alternate extension, then relies on victims to fetch the vCard through the Profile widget. When the response is delivered, the victim's browser or download handler uses the manipulated filename, which can facilitate phishing, mistaken execution, or misclassification by endpoint controls. See the Liferay Security Advisory CVE-2025-43824 for vendor-supplied technical details.

Detection Methods for CVE-2025-43824

Indicators of Compromise

Liferay user profile records containing suspicious characters in the name field such as quotation marks, semicolons, backslashes, or embedded file extensions like .html, .exe, or .svg.
HTTP responses from Profile widget vCard endpoints where the Content-Disposition filename does not end in .vcf.
Unusual downloads of files sourced from /o/ or Profile widget URLs with non-standard extensions.

Detection Strategies

Inspect Liferay access logs for GET requests to Profile widget vCard export endpoints and correlate with the responding Content-Disposition header contents.
Query the user database for firstName, middleName, or lastName values containing quotes, semicolons, or filename-like patterns.
Alert when proxy or web application firewall logs record vCard downloads whose filenames deviate from an expected .vcf extension.

Monitoring Recommendations

Enable verbose HTTP response logging on the Liferay reverse proxy to capture Content-Disposition values for forensic review.
Monitor administrative and self-service profile edit events for anomalous name changes, especially rapid changes preceding external outreach.
Track endpoint download telemetry for unexpected file types originating from Liferay hostnames.

How to Mitigate CVE-2025-43824

Immediate Actions Required

Apply the Liferay-supplied fix or upgrade to a patched release listed in the Liferay Security Advisory CVE-2025-43824.
Audit existing user profiles for names containing characters or substrings that would alter header parsing, and normalize them.
Restrict the Profile widget or vCard export capability on internet-facing sites until patching is complete.

Patch Information

Liferay has published a fixed release for Portal 7.4 and DXP 2023.Q3/Q4 and 7.4 branches. Refer to the vendor advisory for the specific fix pack, service pack, or update number that addresses CVE-2025-43824 in each supported branch, and follow Liferay's standard upgrade procedure for your deployment topology.

Workarounds

Enforce input validation on profile name fields at the application or reverse proxy layer to reject quotes, semicolons, and secondary file extensions.
Add a reverse proxy rule that rewrites the Content-Disposition header for Profile widget vCard responses to a fixed, safe filename ending in .vcf.
Remove or hide the Profile widget from public-facing pages if it is not required for business functionality.

bash

# Example nginx snippet to normalize the vCard filename on Profile widget responses
location ~* /o/.*vcard {
    proxy_pass http://liferay_backend;
    proxy_hide_header Content-Disposition;
    add_header Content-Disposition 'attachment; filename="profile.vcf"';
}