CVE-2025-43767: Liferay DXP Open Redirect Vulnerability

CVE-2025-43767 Overview

CVE-2025-43767 is an Open Redirect vulnerability [CWE-601] affecting the /c/portal/edit_info_item endpoint in Liferay Portal and Liferay Digital Experience Platform (DXP). The redirect parameter fails to validate destination URLs, allowing an attacker to craft links that send authenticated users to attacker-controlled sites. The flaw impacts Liferay Portal versions 7.4.3.86 through 7.4.3.131, Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, and Liferay DXP 7.4 updates 86 through 92. Exploitation relies on user interaction, typically through a phishing lure that leverages the trusted Liferay domain to bypass user suspicion.

Critical Impact
Attackers can weaponize trusted Liferay URLs to redirect users to malicious sites for credential theft, malware delivery, or downstream social engineering attacks.

Affected Products

Liferay Portal 7.4.3.86 through 7.4.3.131
Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12
Liferay DXP 7.4 update 86 through update 92

Discovery Timeline

2025-08-23 - CVE-2025-43767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43767

Vulnerability Analysis

The vulnerability resides in the /c/portal/edit_info_item request handler, which accepts a redirect query parameter used to send users to a follow-up page after processing an info item edit action. The handler does not restrict this parameter to same-origin destinations. An attacker can substitute an external URL, and the server issues an HTTP redirect to that address. Because the initial URL points to a legitimate Liferay instance, URL preview tools, email filters, and users see a trusted domain. This makes the flaw useful as a component of phishing chains, OAuth flow abuse, and social engineering campaigns that require a credible source domain.

Root Cause

The root cause is insufficient validation of user-controlled input passed to the redirect parameter. Liferay's redirect handling should compare the target host to a permitted list of internal hosts or enforce relative paths. In the affected releases, that check either fails to reject fully qualified external URLs or can be bypassed with encoded values. This aligns with CWE-601: URL Redirection to Untrusted Site.

Attack Vector

Exploitation is network-based and requires the victim to click a crafted link. A typical attack constructs a URL of the form https://<liferay-host>/c/portal/edit_info_item?redirect=https://attacker.example/. When the victim follows the link and completes the underlying action, Liferay responds with a redirect to the attacker-supplied destination. The attacker page may spoof a Liferay login screen, deliver a malicious download, or continue an OAuth-style token theft chain. No authentication material on the Liferay side is required beyond what the victim already possesses.

No public proof-of-concept or exploit-in-the-wild reporting exists at the time of writing. Refer to the Liferay Security Advisory CVE-2025-43767 for vendor technical details.

Detection Methods for CVE-2025-43767

Indicators of Compromise

Web server or reverse proxy logs containing requests to /c/portal/edit_info_item with a redirect parameter pointing to an external, non-allowlisted host.
HTTP 302 responses from Liferay carrying a Location header that resolves to a domain outside the organization's trusted list.
Referrer chains in downstream security telemetry showing users arriving at credential-harvesting or malware pages from a legitimate Liferay hostname.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the redirect parameter on /c/portal/edit_info_item and block absolute URLs or values containing :// outside allowlisted domains.
Correlate outbound proxy logs with Liferay access logs to identify redirect chains that pivot from the portal host to unfamiliar external domains.
Add SIEM detections for anomalous redirect parameter values, especially those using URL encoding, protocol-relative syntax //attacker.tld, or backslash tricks.

Monitoring Recommendations

Ingest Liferay access logs and CDN or reverse proxy logs into a centralized analytics platform for query and long-term retention.
Alert on spikes in phishing reports whose landing pages reference Liferay domains in the referrer field.
Monitor authentication events immediately following redirects from Liferay to detect credential replay against portal accounts.

How to Mitigate CVE-2025-43767

Immediate Actions Required

Inventory all Liferay Portal and DXP instances and identify versions within the affected ranges.
Apply the Liferay-supplied fix pack or upgrade to a release outside the vulnerable range as documented in the vendor advisory.
Notify user populations of ongoing phishing risk while patching is in progress, particularly for users with administrative portal access.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-43767. Administrators should upgrade Liferay Portal past 7.4.3.131, apply the corresponding DXP quarterly release fix, or move DXP 7.4 installations beyond update 92 per the advisory instructions.

Workarounds

Configure the reverse proxy or WAF to strip or reject redirect parameters on /c/portal/edit_info_item that reference external hosts.
Enforce a Liferay redirect.url.domains.allowed allowlist so redirect targets are constrained to trusted internal domains.
Restrict access to the /c/portal/edit_info_item endpoint by network segmentation or authentication controls where feasible until patching is complete.

bash

# Example nginx rule to block external redirect targets on the affected endpoint
location /c/portal/edit_info_item {
    if ($arg_redirect ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://liferay_backend;
}