CVE-2025-43802 in Liferay
Summary
by MITRE • 09/16/2025
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/12/2025
This stored cross-site scripting vulnerability exists within the Liferay Portal platform's API endpoint structure, specifically affecting the /o/c/<object-name> endpoint that handles custom objects. The flaw manifests when the externalReferenceCode parameter is processed without adequate input validation or sanitization, creating a persistent XSS vector that can be exploited by remote attackers. The vulnerability impacts multiple versions of both Liferay Portal and Liferay DXP, spanning from 7.4.3.51 through 7.4.3.109 and various update ranges for DXP 2023.Q3 releases, indicating a widespread issue affecting the platform's custom object handling capabilities.
The technical implementation of this vulnerability stems from insufficient sanitization of user-supplied input within the externalReferenceCode parameter processing pipeline. When administrators or users provide data through this parameter, the system fails to properly encode or validate the input before storing it within the application's data structures. This stored data then gets rendered in subsequent page requests without proper output encoding, allowing malicious scripts to execute in the context of other users' browsers. The vulnerability operates as a classic stored XSS attack where the malicious payload is persisted server-side and executed whenever the affected page is accessed, making it particularly dangerous for environments where multiple users interact with the same data.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to steal session cookies, perform unauthorized actions on behalf of users, manipulate application data, and potentially escalate privileges within the platform. Given that this affects custom object endpoints, the attack surface includes any organization using Liferay's custom object functionality for business applications, dashboards, or data management systems. The persistent nature of stored XSS means that once exploited, the malicious code remains active until manually removed from the system, potentially affecting all users who access the vulnerable data. This vulnerability directly maps to CWE-79: Improper Neutralization of Input During Web Page Generation, which is categorized under the OWASP Top Ten as a critical web application security weakness.
Organizations utilizing affected Liferay versions should prioritize immediate remediation through official patches provided by Liferay, as the vulnerability allows for complete browser-based compromise of user sessions. Security teams should implement network-level mitigations including web application firewalls that can detect and block suspicious input patterns targeting the affected API endpoints. Additionally, input validation should be enhanced at multiple layers including API gateway level, application level, and database input sanitization to prevent malicious code from being stored. The ATT&CK framework categorizes this vulnerability under T1566: Phishing with Malicious Attachments and T1059.007: Command and Scripting Interpreter: JavaScript, highlighting the attack vectors and execution methods available to threat actors. Organizations should also conduct thorough security assessments of their custom object implementations to identify any additional input parameters that may be vulnerable to similar attacks, as this vulnerability represents a systemic issue in how user input is handled within the platform's object management systems.