CVE-2021-38265

Vulnerability

Cross-site scripting (XSS) vulnerability in the Asset module of Liferay Portal versions 7.3.4 through 7.3.6. The flaw exists when creating a collection page; the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter is not sanitized before being stored and later rendered [1]. The commit [3] shows the fix adds HtmlUtil.escape() to the collection name.

Exploitation

An attacker with the ability to create collection pages (requires authenticated access with appropriate permissions) can inject arbitrary web script or HTML into the title parameter. When the collection page is viewed by other users, the injected script executes in their browser context. No user interaction beyond viewing the page is required.

Impact

Successful exploitation leads to stored cross-site scripting (XSS). The attacker can execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, defacement, or theft of sensitive information. The attack is persistent as the malicious payload is stored in the collection name.

Mitigation

Liferay addressed this vulnerability in a commit [3] that escapes the collection name using HtmlUtil.escape(). The fix is included in Liferay Portal versions after 7.3.6. Users should upgrade to a patched version. The Liferay security advisory [4] provides details, though the page currently shows an error. No workaround is documented; upgrading is recommended.