N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43770

CVE-2025-43770: Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43770

CVE-2025-43770:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:com.liferay.portal.kernel	maven	< 155.0.0	155.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in Liferay Portal, triggered through the referer and FORWARD_URL parameters. The core of the problem is the insufficient sanitization of these parameters, which can be bypassed using a null byte (%00).

The analysis of the provided commits reveals that the function com.liferay.portal.kernel.util.HtmlUtil.escapeJSLink is the security control responsible for preventing this type of XSS. The patches directly modify the logic within this function to address the vulnerability.

The commit bf20bc07e3e3421d39eaacff052418ce26d791f2 is particularly revealing. It removes a flawed check that relies on the position of the colon character (:). This check was too specific and could be easily bypassed with a null byte, as the null byte would shift the position of the colon, causing the check to fail and the malicious script to pass through unsanitized.

The patch replaces the weak check with link.contains("javascript:"). The commit message, "Simplifly and prevent null byte injection," indicates that this change is intended to correctly handle strings containing null bytes and prevent the bypass.

Therefore, com.liferay.portal.kernel.util.HtmlUtil.escapeJSLink is the vulnerable function. During an exploit, this function would be present in the runtime profile, as it is the point where the malicious input is processed. The vulnerability is not that the function is inherently malicious, but that its sanitization logic was inadequate and could be circumvented.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.