CVE-2024-25606 Overview
CVE-2024-25606 is an XML External Entity (XXE) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Java2WsddTask._format method, which processes XML input without properly disabling external entity resolution. Attackers with permission to deploy widgets, portlets, or extensions can supply crafted XML that references external entities. Successful exploitation allows retrieval of sensitive files from the host or exhaustion of system resources. The issue is tracked under CWE-611: Improper Restriction of XML External Entity Reference.
Critical Impact
Authenticated attackers can read sensitive files on the Liferay server or trigger denial-of-service conditions by abusing the vulnerable XML parser in Java2WsddTask._format.
Affected Products
- Liferay Portal 7.2.0 through 7.4.3.7 and older unsupported versions
- Liferay DXP 7.4 before update 4 and 7.3 before update 12
- Liferay DXP 7.2 before fix pack 20 and older unsupported versions
Discovery Timeline
- 2024-02-20 - CVE-2024-25606 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-25606
Vulnerability Analysis
The vulnerability is an XML External Entity (XXE) flaw in the Java2WsddTask._format method used by Liferay Portal and DXP. The underlying XML parser processes documents without disabling external entity resolution or DTD (Document Type Definition) processing. When a user with deploy privileges submits a widget, portlet, or extension containing crafted XML, the parser dereferences attacker-controlled external entities during processing.
An attacker can define a SYSTEM entity pointing to local files such as /etc/passwd or internal HTTP endpoints. The resolved content is reflected back through parser output or side channels, disclosing sensitive information. The scope-changed impact reflects that data outside the vulnerable component can be reached, including files readable by the Liferay service account.
Root Cause
The root cause is missing hardening on the XML parser instantiated inside Java2WsddTask._format. Secure parsing features such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, and external-general-entities are not enforced. Without these features disabled, any XML processed through this code path resolves external entities defined by the input document.
Attack Vector
Exploitation requires an authenticated account with permission to deploy widgets, portlets, or extensions. The attacker crafts an XML payload containing an external entity declaration and submits it through the deployment interface. Because processing occurs server-side, the attacker can request local files or coerce the server to fetch internal URLs, enabling both information disclosure and resource-consumption attacks. No user interaction beyond the authenticated attacker is required.
Refer to the Liferay Security Advisory CVE-2024-25606 for vendor-provided technical detail.
Detection Methods for CVE-2024-25606
Indicators of Compromise
- Deployment or upload of WSDD, WSDL, or widget XML files containing <!DOCTYPE declarations or <!ENTITY ... SYSTEM ...> references
- Outbound HTTP or FTP requests from the Liferay JVM to unexpected external hosts following portlet or widget deployment
- Read access from the Liferay service account to sensitive files such as /etc/passwd, /etc/shadow, or Liferay configuration files without a matching administrative workflow
- Sudden spikes in CPU or memory usage on the Liferay node during XML processing, consistent with billion-laughs style entity expansion
Detection Strategies
- Inspect audit logs for deployments performed by non-standard administrator accounts and correlate with XML payload contents
- Monitor Liferay application logs for SAX parser exceptions referencing DOCTYPE, ENTITY, or external DTD failures
- Deploy web application firewall rules that flag XML payloads containing SYSTEM or PUBLIC entity keywords delivered to Liferay deployment endpoints
Monitoring Recommendations
- Alert on egress connections initiated by the Liferay JVM to hosts outside expected update or integration endpoints
- Track file access patterns on the Liferay host and alert on reads of sensitive OS or credential files by the application user
- Enable verbose logging on portlet and widget deployment operations to preserve payload metadata for retrospective analysis
How to Mitigate CVE-2024-25606
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release beyond 7.4.3.7 and Liferay DXP to 7.4 update 4, 7.3 update 12, or 7.2 fix pack 20 or later
- Restrict the DEPLOY and portlet management permissions to a minimal set of trusted administrators
- Review recent deployment history for unauthorized widgets, portlets, or extensions and remove any suspicious artifacts
- Rotate credentials and API keys stored on the Liferay host if unauthorized file reads are suspected
Patch Information
Liferay has released updates addressing CVE-2024-25606. Apply Liferay DXP 7.4 update 4, 7.3 update 12, or 7.2 fix pack 20, or upgrade Liferay Portal past 7.4.3.7. Consult the Liferay Security Advisory CVE-2024-25606 for exact release artifacts and installation guidance.
Workarounds
- Remove deploy permissions from all accounts that do not strictly require them until patches are applied
- Place the Liferay deployment interface behind network segmentation or VPN access to reduce exposure
- Configure egress filtering on the Liferay host so the JVM cannot initiate outbound connections to arbitrary external endpoints
- Enable enhanced audit logging for all portlet and widget deployment actions to support rapid incident response
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
