CVE-2025-3586: Liferay DXP RCE Vulnerability

CVE-2025-3586 Overview

CVE-2025-3586 is an authorization weakness [CWE-863] in Liferay Portal and Liferay DXP that allows authenticated administrators to execute arbitrary Groovy scripts through the Objects module. The Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. Remote authenticated users holding the Instance Administrator role can leverage Object actions to achieve remote code execution on the underlying server. The flaw affects self-hosted and PaaS deployments, while Liferay SaaS instances are not impacted because Groovy execution is disabled by default in that tier.

Critical Impact

Authenticated administrators can execute arbitrary Groovy scripts on the host, achieving full remote code execution with the privileges of the Liferay application process.

Affected Products

• Liferay Portal 7.4.3.27 through 7.4.3.42
• Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, and 2023.Q3.1 through 2023.Q3.10
• Liferay DXP 7.4 update 27 through update 42 (Liferay PaaS and Liferay Self-Hosted)

Discovery Timeline

• 2025-09-01 - CVE-2025-3586 published to NVD
• 2025-12-12 - Last updated in NVD database

Technical Details for CVE-2025-3586

Vulnerability Analysis

The Objects module in affected Liferay versions exposes Groovy scripting inside Object actions without enforcing a policy that restricts script execution for Instance Administrators. Groovy provides direct access to the underlying Java Virtual Machine, including file system, network, and process APIs. An attacker authenticated as an Instance Administrator can author or modify an Object action that invokes a Groovy script, then trigger that action to execute attacker-controlled code in the context of the Liferay server process.

This condition is classified as an Incorrect Authorization issue [CWE-863]. The functionality is intended for trusted operators, but the absence of a configurable allow-list or a deny-by-default control means any account granted Instance Administrator effectively obtains remote code execution. Liferay's SaaS tier disables Groovy in Object actions for this reason. Starting with Liferay DXP 2024.Q2, Instance Settings exposes a toggle that controls whether Groovy scripts are permitted.

Root Cause

The root cause is missing authorization and policy enforcement around a privileged scripting feature. The Objects module accepts and executes Groovy code from Object actions without gating it behind a separate, explicit administrative capability or a tenant-level configuration check.

Attack Vector

Exploitation requires network access to the Liferay administrative interface and valid credentials for an account holding the Instance Administrator role. The attacker creates or edits an Object action, supplies a Groovy payload that invokes Java runtime APIs, and triggers the action. The payload then executes inside the Liferay JVM, allowing command execution, file read or write, lateral movement, and credential theft from the application context.

No verified public proof-of-concept code is available. See the Liferay Security Advisory CVE-2025-3586 for vendor-supplied technical details.

Detection Methods for CVE-2025-3586

Indicators of Compromise

• Creation or modification of Object actions that reference Groovy scripts, particularly by accounts that do not normally administer Objects.
• Liferay application logs showing Groovy script compilation or execution events triggered from Object action workflows.
• Outbound network connections, child process spawns, or file writes originating from the Liferay JVM process shortly after Object action changes.

Detection Strategies

• Audit the Liferay database and configuration for Object actions whose action type is set to Groovy script, and review the script bodies for suspicious system calls such as Runtime.exec, ProcessBuilder, or new File(...).
• Correlate administrative login events with subsequent Object action creation, edit, or trigger events to flag short-window privilege abuse patterns.
• Monitor for unexpected child processes of the Liferay or Tomcat process, including shells, scripting interpreters, and reconnaissance binaries.

Monitoring Recommendations

• Forward Liferay audit logs, application server logs, and host process telemetry to a centralized analytics platform for retention and correlation.
• Alert on any change to Instance Administrator role membership and on configuration changes to the Groovy allow setting introduced in 2024.Q2 and later.
• Baseline normal Object action usage per tenant so that new Groovy-based actions surface as deviations rather than routine activity.

How to Mitigate CVE-2025-3586

Immediate Actions Required

• Upgrade affected Liferay Portal and Liferay DXP instances to a fixed release as documented in the Liferay Security Advisory CVE-2025-3586.
• On Liferay DXP 2024.Q2 and later, set the Instance Settings option to disallow Groovy scripts unless a documented business need exists.
• Review and reduce the number of accounts holding the Instance Administrator role, and enforce strong authentication including multi-factor authentication for those accounts.

Patch Information

Liferay has published guidance and fixed versions through the vendor advisory. Administrators should consult the Liferay Security Advisory CVE-2025-3586 for the specific Portal and DXP releases that address this issue and apply the corresponding update for their deployment tier.

Workarounds

• Restrict access to the Liferay administrative interface using network controls, VPN, or IP allow-listing so that only trusted operators can reach the Objects module.
• Remove existing Object actions that use Groovy scripts where they are not strictly required, and prohibit their creation through internal change-control policy.
• Rotate administrative credentials and review audit logs for unauthorized Object action changes prior to applying the patch.

# Configuration example: disable Groovy in Object actions (Liferay DXP 2024.Q2+)
# Navigate: Control Panel > Instance Settings > Objects
# Set the option that allows Groovy scripts in Object actions to: false
# Then restart the Liferay node to ensure the policy is enforced cluster-wide.