CVE-2025-43745: Liferay DXP CSRF Vulnerability

CVE-2025-43745 Overview

CVE-2025-43745 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in an endpoint parameter that permits remote attackers to trigger cross-origin requests on behalf of an authenticated user. Successful exploitation requires user interaction, typically by luring a signed-in user to visit an attacker-controlled page. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can coerce an authenticated Liferay user's browser into issuing arbitrary cross-origin requests through the vulnerable endpoint parameter, potentially exposing confidential portal data.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 7.4 GA through update 92
Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.1 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.14, and 2025.Q2.0 through 2025.Q2.7

Discovery Timeline

2025-08-19 - CVE-2025-43745 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43745

Vulnerability Analysis

The vulnerability is a CSRF weakness classified under [CWE-352]. Liferay processes requests targeting an endpoint parameter without adequately verifying the origin of the request or the presence of an anti-CSRF token. An authenticated user who visits a malicious page can have their browser silently forward a state-changing request to the Liferay instance. Because the request rides on the user's existing session cookies, the application treats it as legitimate. The scope is confined to actions the victim account is authorized to perform, which shapes the confidentiality impact.

Root Cause

The root cause is missing or insufficient CSRF protection on request handling that accepts an attacker-controllable endpoint parameter. Liferay does not validate that the request originates from a trusted context, allowing cross-origin submissions to be honored when accompanied by valid session credentials.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a webpage containing an auto-submitting form or a script that issues a request to the target Liferay instance. When an authenticated user loads that page, the browser attaches session cookies and delivers the forged request. The endpoint parameter directs the request to a sensitive handler within the portal.

No public proof-of-concept or exploit is currently listed in ExploitDB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.231%. Refer to the Liferay Security Advisory CVE-2025-43745 for vendor-supplied technical detail.

// No verified public exploit code is available for CVE-2025-43745.
// See the Liferay advisory referenced above for technical details.

Detection Methods for CVE-2025-43745

Indicators of Compromise

Requests to Liferay handlers containing an endpoint parameter with a Referer or Origin header pointing to an untrusted external domain.
Unexpected state changes performed by authenticated user accounts shortly after they browsed external content.
HTTP requests to the portal lacking the Liferay CSRF token (p_auth) yet completing successfully against sensitive routes.

Detection Strategies

Inspect Liferay access logs for cross-origin POST or GET requests that include the endpoint parameter and correlate them with user session activity.
Deploy a web application firewall (WAF) rule that flags Liferay requests carrying an external Origin or Referer header.
Baseline the normal Referer distribution for authenticated portal actions and alert on deviations.

Monitoring Recommendations

Forward Liferay application and access logs to a centralized SIEM for correlation with browser and endpoint telemetry.
Monitor for spikes in failed CSRF token validations after applying the vendor patch, which can reveal ongoing exploitation attempts.
Track outbound browser traffic from privileged Liferay administrators to detect visits to suspicious sites that could stage CSRF payloads.

How to Mitigate CVE-2025-43745

Immediate Actions Required

Upgrade Liferay Portal to a release beyond 7.4.3.132 and Liferay DXP to a fixed quarterly release or update as documented in the vendor advisory.
Restrict administrative access to the Liferay portal to trusted networks or VPN users while patching is planned.
Enforce short session lifetimes and require re-authentication for sensitive administrative actions.

Patch Information

Liferay has documented the fix in the Liferay Security Advisory CVE-2025-43745. Administrators should review the advisory to identify the correct fix pack or update level for their subscription channel and apply it across all Portal and DXP instances.

Workarounds

Configure the Liferay auth.token.check.enabled property to true to enforce CSRF token validation on portal actions.
Add a reverse proxy or WAF rule that rejects requests to Liferay endpoints when the Origin or Referer header is missing or does not match the portal's own hostname.
Instruct administrators to use dedicated browser profiles or isolated sessions when signed in to the Liferay portal.

bash

# Enforce CSRF token validation in portal-ext.properties
auth.token.check.enabled=true
auth.token.impl=com.liferay.portal.security.auth.SessionAuthToken