Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in the Language Override feature of Liferay Portal and Liferay DXP. It allows remote attackers to inject arbitrary web scripts or HTML through a specific parameter named `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId`. This means an attacker can craft a malicious URL that, when visited by a user, can execute unwanted scripts in the user's browser. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to execute arbitrary scripts in the context of the affected website, potentially leading to theft of user data, session hijacking, or other malicious actions performed on behalf of the user. Since it requires user interaction (UI:A), the attacker needs to trick users into clicking a crafted link. The impact severity is moderate with a CVSS score of 5.1. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing for reflected cross-site scripting (XSS) via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter in affected Liferay Portal or DXP versions. You can use tools like curl or a web proxy to send HTTP requests with crafted payloads in this parameter and observe if the payload is reflected unescaped in the response. For example, using curl: curl -v 'http://<target>/path?_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId=<script>alert(1)</script>' and checking if the script is executed or reflected in the response. Automated scanners that test for reflected XSS vulnerabilities can also be used targeting this parameter. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading affected Liferay Portal and DXP installations to fixed versions: Liferay Portal 7.4.3.112 or later, and Liferay DXP 2024.Q1.1 or later. If upgrading is not immediately possible, consider applying web application firewall (WAF) rules to block or sanitize requests containing suspicious input in the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter to prevent script injection. Additionally, ensure that user input is properly validated and escaped in the application to prevent XSS. [1]

Useful 0 Not Useful 0