CVE-2025-43747 Overview
CVE-2025-43747 is a server-side request forgery (SSRF) vulnerability in Liferay Digital Experience Platform (DXP) versions 2025.Q2.0 through 2025.Q2.3. The flaw resides in the domain validation logic for the analytics.cloud.domain.allowed configuration property. The validation routine fails to distinguish between trusted subdomains and attacker-controlled domains, allowing authenticated users to redirect server-initiated requests to arbitrary destinations. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated attacker with high privileges can abuse the analytics domain allowlist to make the Liferay server issue requests to unintended internal or external endpoints, exposing limited data and integrity impact.
Affected Products
- Liferay DXP 2025.Q2.0
- Liferay DXP 2025.Q2.1 through 2025.Q2.2
- Liferay DXP 2025.Q2.3
Discovery Timeline
- 2025-08-21 - CVE-2025-43747 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43747
Vulnerability Analysis
The vulnerability affects the analytics integration component of Liferay DXP. Liferay DXP allows administrators to configure allowed analytics cloud domains through the analytics.cloud.domain.allowed property. The application uses this allowlist to validate outbound requests directed at analytics endpoints.
The validation logic performs an insufficient match against the configured domain values. It does not properly separate trusted subdomains from arbitrary hostnames that contain or resemble the trusted domain. An attacker can craft a domain value that satisfies the flawed check while pointing to a host under their control. The Liferay server then issues an HTTP request to that host on behalf of the attacker.
Exploitation requires an authenticated account with elevated privileges and involves user interaction. The resulting SSRF affects confidentiality, integrity, and downstream systems reachable from the Liferay instance, including internal services that trust requests originating from the application server.
Root Cause
The root cause is improper domain validation on the analytics.cloud.domain.allowed property. The validator treats domain strings as substrings or partial matches rather than performing strict hostname parsing and equality checks against a canonical allowlist. This design permits attacker-controlled hostnames that share tokens with the trusted analytics domain to pass validation.
Attack Vector
An attacker with a privileged account modifies the analytics domain configuration to include a malicious value that bypasses the allowlist check. When the analytics client subsequently issues a request, it targets the attacker-controlled host or an internal service. Consult the Liferay CVE-2025-43747 Notification for vendor guidance and version-specific fix details.
No public proof-of-concept exploit code is available for this vulnerability. The vulnerability mechanism is described in prose above rather than through synthetic code.
Detection Methods for CVE-2025-43747
Indicators of Compromise
- Unexpected changes to the analytics.cloud.domain.allowed configuration property, particularly values containing non-Liferay analytics hostnames.
- Outbound HTTP or HTTPS requests from the Liferay application server to hosts that are not part of the documented Liferay Analytics Cloud infrastructure.
- Requests from the Liferay server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints such as 169.254.169.254.
Detection Strategies
- Monitor configuration audit logs for modifications to analytics-related properties and correlate them with the initiating user account.
- Inspect egress proxy or firewall logs for outbound traffic originating from Liferay hosts and destined for uncategorized domains.
- Alert on failed or anomalous DNS resolutions requested by the Liferay JVM process.
Monitoring Recommendations
- Enforce egress filtering that restricts the Liferay server to a documented allowlist of external destinations.
- Instrument the Liferay JVM with request logging to capture destination URLs generated by the analytics client.
- Review privileged account activity, since exploitation requires an account with high privileges as reflected in the CVSS vector.
How to Mitigate CVE-2025-43747
Immediate Actions Required
- Upgrade Liferay DXP to a fixed release beyond 2025.Q2.3 as identified in the vendor advisory.
- Audit the current value of analytics.cloud.domain.allowed and remove any entries that do not correspond to official Liferay Analytics Cloud domains.
- Review the roster of administrative accounts and revoke access for accounts that do not require configuration privileges.
Patch Information
Liferay has published fix guidance in the Liferay CVE-2025-43747 Notification. Apply the vendor-supplied service pack or hotfix that addresses the domain validation logic for the affected 2025.Q2 branch.
Workarounds
- Restrict outbound network access from the Liferay server using host-based or network firewalls to permit connections only to known Liferay Analytics Cloud endpoints.
- Remove or disable the analytics integration if it is not used in the deployment, which eliminates the vulnerable code path.
- Route Liferay egress traffic through a forward proxy that enforces domain allowlisting independent of the application's internal validation.
# Example egress restriction using iptables to limit Liferay outbound HTTPS
# Replace <ANALYTICS_IP> with the official Liferay Analytics Cloud IP range
iptables -A OUTPUT -p tcp -d <ANALYTICS_IP> --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
