CVE-2025-43777: Liferay DXP Information Disclosure Flaw

CVE-2025-43777 Overview

CVE-2025-43777 is an information disclosure vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The application returns an "Internal Server Error" message in the response body when a login attempt uses a deleted Client Secret. This behavior exposes internal application state that attackers can leverage to enumerate credential status during OAuth-based authentication flows. The issue is classified under [CWE-209: Generation of Error Message Containing Sensitive Information]. Affected releases include Liferay Portal 7.4.0 through 7.4.3.132 and multiple Liferay DXP quarterly releases from 2024.Q1 through 2025.Q2.

Critical Impact
Authenticated attackers can distinguish between valid and deleted Client Secrets by observing distinct server error responses, aiding credential enumeration and reconnaissance against OAuth clients.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2025.Q2.0 through 2025.Q2.9 and 2025.Q1.0 through 2025.Q1.16
Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, and 2024.Q4.0 through 2024.Q4.7

Discovery Timeline

2025-09-09 - CVE-2025-43777 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43777

Vulnerability Analysis

The vulnerability resides in the authentication path that validates OAuth Client Secrets during login. When a client attempts authentication with a Client Secret that has been deleted, the Liferay platform returns a generic "Internal Server Error" response instead of a controlled authentication failure. The response body reveals server-side state that should remain opaque to callers.

An attacker with low-privilege network access and the ability to submit crafted login requests can distinguish this error condition from other authentication failures. This differential response supports credential enumeration and reconnaissance workflows against OAuth integrations. The issue does not directly permit code execution or data modification, but it weakens authentication hygiene across affected deployments.

Root Cause

The root cause is improper error handling during Client Secret validation. The authentication component fails to normalize error responses when the referenced Client Secret record no longer exists in the datastore. Instead of returning a uniform authentication error, the platform surfaces an internal exception state in the HTTP response body, which qualifies as sensitive information exposure under [CWE-209].

Attack Vector

Exploitation occurs over the network against the Liferay authentication endpoint used by OAuth clients. The attacker submits login attempts referencing Client Secrets that they suspect have been deleted or rotated. By comparing responses across valid, invalid, and deleted secrets, the attacker maps the state of OAuth clients registered in the portal.

The vulnerability manifests in server-side error handling logic. Refer to the Liferay Security Advisory CVE-2025-43777 for vendor-specific technical details.

Detection Methods for CVE-2025-43777

Indicators of Compromise

Repeated OAuth login attempts from the same source IP against /o/oauth2/token or equivalent authentication endpoints returning HTTP 500 responses.
Response bodies containing the string Internal Server Error correlated to authentication requests rather than genuine service failures.
Enumeration patterns iterating through multiple Client IDs or Client Secret values in short time windows.

Detection Strategies

Parse Liferay access logs for HTTP 500 status codes tied to authentication URIs and group by source IP and user agent to spot enumeration.
Correlate application server exception logs referencing Client Secret validation with corresponding external HTTP responses.
Establish a baseline for legitimate OAuth error rates and alert on statistically significant deviations from that baseline.

Monitoring Recommendations

Forward Liferay portal, application server, and reverse proxy logs to a centralized analytics platform for correlation and long-term retention.
Instrument alerts on high-volume authentication failures against OAuth endpoints, particularly when tied to deleted or rotated client credentials.
Track administrative actions that delete or disable OAuth Client Secrets and correlate them with subsequent authentication traffic referencing those identifiers.

How to Mitigate CVE-2025-43777

Immediate Actions Required

Inventory all Liferay Portal and Liferay DXP instances against the affected version ranges and prioritize internet-facing deployments.
Apply the vendor-supplied fix referenced in the Liferay Security Advisory.
Rotate any OAuth Client Secrets that may have been probed and audit OAuth client inventories for stale or deleted entries.

Patch Information

Liferay has published guidance and fixes in the vendor advisory. Administrators should upgrade to a Liferay Portal build later than 7.4.3.132 and to Liferay DXP releases beyond the affected quarterly versions listed above. Consult the Liferay Security Advisory CVE-2025-43777 for the authoritative patch matrix.

Workarounds

Place a reverse proxy or web application firewall in front of Liferay to normalize HTTP 500 responses on authentication endpoints into generic authentication errors.
Restrict access to OAuth token and login endpoints via IP allowlists where clients are known and static.
Enforce strict lifecycle management for OAuth clients so that deleted Client Secrets do not remain referenced in downstream integrations.

bash

# Example reverse proxy rule to normalize 500 responses on the OAuth token endpoint
# (adapt to your ingress or WAF technology)
location /o/oauth2/token {
    proxy_pass http://liferay_upstream;
    proxy_intercept_errors on;
    error_page 500 502 503 504 =401 /oauth-error;
}

location = /oauth-error {
    return 401 '{"error":"invalid_client"}';
    add_header Content-Type application/json;
}