Security Listings

9.6

CVE-2024-25145 Stored XSS with search results if highlighting is disabled

Description

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Severity

9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

Affected Version(s)

Liferay Portal 7.4.0 through 7.4.3.11
Liferay Portal 7.3.0 through 7.3.7
Liferay Portal 7.2.0 and 7.2.1
Liferay Portal, older unsupported versions
Liferay DXP 7.4 before update 8
Liferay DXP 7.3 before update 4
Liferay DXP 7.2 before fix pack 17
Liferay DXP, older unsupported versions

The reason for step #7 to alter the source files rather than the merged files has to do with supporting future updates.

I do have a script available here

that can successfully get you to the joined yaml file ready for the openapi generator to run.

Fixed Version(s)

If I change a custom Object, such as my Vacation Object, that will change the headless endpoints, so I'll need a new client with the updates. I can go through the steps above, but I only have to worry about the one Vacation YAML file, my other YAMLs wouldn't have necessarily changed. Since the updates for the validation failures happen in the source files, the new merged file would pull the fixes in and the client generation should only report validation failures from the Vacation

YAML alone.

So sure, updating the source file means I need to do the join again, but that will always be easier than having to fix validation errors after every join.

I have an even better script available here which can handle the YAML cleanups, the YAML merge, and then generate the client project.

Conclusion

Generating the client code is likely unnecessary for simple applications where you're just using a handful of calls.

But when you are accessing multiple custom Objects and Liferay Headless APIs, manually writing code to access those endpoints is going to be a chore.

I used the javascript generated client for one of my React applications recently, and it really worked out quite well. I could focus on my actual code instead of worrying about writing all of the client methods...

Anyway I hope you find this useful, even though it is one of my longer posts...
Liferay Portal 7.4.3.12
Liferay DXP 7.4 update 8
Liferay DXP 7.3 update 4
Liferay DXP 7.2 fix pack 17