CVE-2025-43763 Overview
CVE-2025-43763 is a server-side request forgery (SSRF) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in custom object attachment fields and allows an authenticated attacker to coerce the application into issuing unauthorized outbound requests. Attackers can create new object entries that link to external resources controlled by the attacker or reachable only from the server. The weakness is classified as [CWE-918] Server-Side Request Forgery.
Critical Impact
An attacker with elevated portal privileges can pivot Liferay into internal networks, generate object entries referencing arbitrary URLs, and exfiltrate or manipulate data reachable from the Liferay server.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.131
- Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13
- Liferay DXP 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20
Discovery Timeline
- 2025-09-09 - CVE-2025-43763 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43763
Vulnerability Analysis
Liferay exposes custom object attachment fields that accept URL-based references to external files. The affected versions fail to validate or restrict the destinations that the server dereferences when processing these attachment references. An authenticated user submits an object entry containing a crafted URL, and the Liferay server issues the outbound HTTP request on the attacker's behalf. The response, or the side effect of the request, becomes accessible through the newly created object entry.
This pattern enables classic SSRF outcomes: reaching internal management interfaces, querying cloud instance metadata endpoints, and probing internal services that are not exposed to the public network. Because Liferay commonly runs inside enterprise networks with broad east-west connectivity, the blast radius extends beyond the portal itself.
The EPSS probability is 0.196%, placing the vulnerability in the lower percentile of predicted exploitation activity, and no public proof-of-concept has been observed.
Root Cause
The root cause is insufficient validation of user-supplied URLs assigned to custom object attachment fields. The application accepts arbitrary schemes and destinations without enforcing an allowlist, protocol restrictions, or DNS rebinding protection. When Liferay resolves the attachment, it initiates a server-originated request to the attacker-controlled target.
Attack Vector
Exploitation requires network access to the Liferay instance and an authenticated account with permission to create or modify object entries containing attachment fields. The attacker submits an object entry whose attachment URL points to an internal host, cloud metadata service, or third-party callback endpoint. User interaction is required by the CVSS vector, typically an administrative view or process that triggers the attachment fetch.
The vulnerability is described in the Liferay Security Advisory for CVE-2025-43763. No verified exploit code is available at this time.
Detection Methods for CVE-2025-43763
Indicators of Compromise
- Outbound HTTP requests originating from the Liferay JVM to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to cloud metadata endpoints such as 169.254.169.254.
- New object entries containing attachment URLs referencing non-standard hosts, IP literals, or unusual ports.
- Portal application logs showing attachment resolution failures against unexpected external domains.
Detection Strategies
- Inspect Liferay access and object-service logs for PUT/POST operations that populate attachment fields with URL values pointing outside approved content sources.
- Correlate egress firewall logs with the Liferay server's process identity to surface anomalous outbound destinations following object creation events.
- Baseline normal attachment domains per environment and alert on deviations, including IPv6 literals and encoded URL variants used to bypass allowlists.
Monitoring Recommendations
- Enable NetFlow or equivalent egress telemetry on the Liferay tier and forward it to a centralized analytics platform for retrospective hunting.
- Monitor authenticated privileged accounts for unusual patterns of object creation involving attachment fields.
- Track requests to cloud instance metadata services from any application server and alert on the first occurrence.
How to Mitigate CVE-2025-43763
Immediate Actions Required
- Upgrade Liferay Portal and DXP to the fixed releases published in the Liferay CVE-2025-43763 advisory.
- Restrict outbound network access from the Liferay application tier using egress firewalls, permitting only required destinations.
- Audit accounts with permission to create or edit custom objects containing attachment fields and remove unnecessary privileges.
Patch Information
Liferay has released fixed versions for Portal 7.4 and DXP quarterly releases 2024.Q1 through 2024.Q4. Consult the Liferay Security Advisory for the exact fix versions corresponding to each supported branch and apply the update through the standard Liferay upgrade path.
Workarounds
- Block the Liferay server from initiating connections to internal RFC1918 ranges and to the cloud metadata endpoint 169.254.169.254 at the network layer.
- Disable or restrict custom object attachment field creation for non-administrative roles until patching is complete.
- Route outbound HTTP traffic from Liferay through a forward proxy that enforces a domain allowlist and rejects requests to private address space.
# Example egress restriction using iptables on the Liferay host
iptables -A OUTPUT -m owner --uid-owner liferay -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner liferay -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner liferay -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner liferay -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
