CVE-2016-10404

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Liferay Portal versions before 7.0 CE GA4 in the file modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp [1]. The vulnerability is introduced because the value returned by spaUtil.getLoginRedirect(request) is rendered directly into a JavaScript string without HTML escaping [3]. The fix, introduced in commit 333f65bae9106182d12e02d249d4f95e16e93fa2, wraps the output with HtmlUtil.escapeJS() to sanitize the redirect field [3].

Exploitation

An attacker must be able to supply a crafted redirect parameter to the application, for example via a phishing link or by chaining with another vector that controls the redirect value. No special authentication is required if the affected component is accessible to unauthenticated users; the attacker only needs to lure a victim into visiting a crafted URL. The crafted redirect value can include JavaScript payloads, which will be executed in the context of the user's session when the SPA framework processes the login redirect [3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, theft of sensitive information, defacement, or redirection to malicious sites. The impact is limited by the fact that the attacker controls only the redirect parameter, but the XSS runs in the context of the Liferay Portal domain, potentially affecting any user who triggers the vulnerable function.

Mitigation

The vulnerability is fixed in Liferay Portal 7.0 CE GA4 and later versions. Users should upgrade to at least GA4 or apply the patch that escapes the redirect value using HtmlUtil.escapeJS() [3]. No workarounds are documented; the only effective mitigation is to update Liferay Portal to a patched release [1]. For users on older versions, upgrading to the latest CE GA or migrating to Liferay DXP is recommended [2].