CVE-2023-42629
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in Liferay Portal/DXP allows attackers to inject malicious scripts into vocabulary descriptions. When users view the affected vocabulary page, the script executes in their browser context. This affects administrators and users with access to vocabulary management pages.
💻 Affected Systems
- Liferay Portal
- Liferay DXP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface the portal, or redirect users to malicious sites.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed by authenticated users viewing the compromised vocabulary page.
If Mitigated
Limited impact if proper content security policies and input validation are enforced, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires authenticated access to vocabulary management, but the XSS payload execution affects all users viewing the page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Liferay Portal 7.4.3.88+, Liferay DXP 7.4 update 88+
Vendor Advisory: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629
Restart Required: Yes
Instructions:
1. Download the appropriate fix pack from Liferay's customer portal. 2. Apply the fix pack following Liferay's patch deployment procedures. 3. Restart the Liferay instance. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize vocabulary description fields
Implement custom servlet filter or hook to sanitize HTML input in vocabulary management
Content Security Policy
allEnforce strict CSP headers to mitigate XSS impact
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict access to vocabulary management pages to only essential administrators
- Implement web application firewall rules to block XSS payloads in vocabulary descriptions
🔍 How to Verify
Check if Vulnerable:
Check Liferay version via Control Panel → Configuration → Server Administration → System InformationCheck Version:
Check liferay.home/portal/version.jsp or Control Panel → Configuration → Server AdministrationVerify Fix Applied:
Verify version is 7.4.3.88+ for Portal or 7.4 update 88+ for DXP, then test vocabulary description field with basic XSS payload📡 Detection & Monitoring
Log Indicators:
- Unusual vocabulary creation/modification patterns
- HTML/script tags in vocabulary description fields
Network Indicators:
- Unexpected outbound connections from Liferay portal pages
- Suspicious JavaScript execution patterns
SIEM Query:
source="liferay" AND (event="vocabulary_update" OR event="vocabulary_create") AND description CONTAINS "<script>"🔗 References
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629
- https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629
- https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/
