CVE-2025-43786: Liferay DXP Information Disclosure Flaw

CVE-2025-43786 Overview

CVE-2025-43786 is a timing-based information disclosure vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows unauthenticated attackers to enumerate valid External Reference Codes (ERCs) associated with object entries by measuring differences in server response times. Because the application takes measurably different amounts of time to process requests referencing existing versus non-existing ERCs, attackers can distinguish valid identifiers without any authentication. The issue is categorized under [CWE-203] (Observable Discrepancy) and [CWE-79]. Successful enumeration exposes internal identifiers that can be used to plan subsequent attacks on object entries.

Critical Impact
Unauthenticated remote attackers can enumerate valid ERC identifiers in Liferay object entries through response-time analysis, exposing internal application resources for follow-on attacks.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.128
Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, and 2023.Q4.0
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-09-09 - CVE-2025-43786 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43786

Vulnerability Analysis

The vulnerability is a timing side-channel attack against Liferay's object entry lookup logic. When a request references an ERC, the application performs different processing paths depending on whether the ERC exists. Requests for valid ERCs consume additional server time performing lookup, permission, or validation logic, while requests for non-existent ERCs return more quickly.

By issuing repeated requests and statistically comparing response times, an attacker distinguishes valid ERCs from invalid ones. This is a classic Observable Discrepancy weakness where a security-sensitive control leaks information through a side channel rather than through explicit output.

Enumeration of ERCs is a precursor step. Once valid identifiers are known, attackers can target them with follow-on exploitation such as unauthorized access attempts, brute-force operations on associated data, or chained attacks against object entry APIs.

Root Cause

The root cause is inconsistent execution time between the code paths handling valid and invalid ERC values. The application does not apply constant-time comparison or uniform processing when validating whether an ERC exists, allowing timing measurements to reveal the outcome of the lookup.

Attack Vector

Exploitation requires only network access to the Liferay instance. No authentication and no user interaction are required. An attacker submits a sequence of HTTP requests referencing candidate ERC values against the object entry endpoints and records the response latency for each. Statistical analysis of the timing distribution reveals which candidates correspond to existing ERCs.

See the Liferay Security Advisory CVE-2025-43786 for vendor-provided technical details.

Detection Methods for CVE-2025-43786

Indicators of Compromise

High volumes of HTTP requests to object entry endpoints from a single source IP or narrow range of IPs, each referencing distinct ERC values
Repetitive request patterns that iterate through predictable ERC identifiers or dictionary-style strings
Requests originating from automated tooling with atypical user-agent strings or missing browser-like headers

Detection Strategies

Monitor Liferay access logs for enumeration behavior: many sequential requests to the same endpoint with varied ERC parameters and no session state
Correlate response-time distributions per client to detect timing-oracle probing, where a client issues many requests and measures latencies
Rate-limit and alert on unauthenticated traffic to object entry APIs that exceeds normal baselines

Monitoring Recommendations

Enable verbose logging on Liferay object entry endpoints and forward logs to a centralized analytics platform
Baseline normal request rates to /o/c/ and related object endpoints, then alert on statistical anomalies
Track source IPs that generate high 404 or not-found ratios against object endpoints, indicative of enumeration

How to Mitigate CVE-2025-43786

Immediate Actions Required

Upgrade Liferay Portal to a version beyond 7.4.3.128 and Liferay DXP to a patched quarterly release as identified by the vendor advisory
Restrict network exposure of object entry endpoints to authenticated users where the business logic permits
Deploy rate limiting and WAF rules to throttle unauthenticated enumeration attempts against object APIs

Patch Information

Liferay has published guidance in the Liferay Security Advisory CVE-2025-43786. Administrators should apply the referenced fix pack or upgrade to a release that includes the corrected object entry handling that eliminates the timing discrepancy.

Workarounds

Place object entry endpoints behind authentication where possible until the patch is applied
Configure a reverse proxy or WAF to enforce request rate limits per source IP against object APIs
Add artificial jitter or uniform response delays at the reverse proxy layer to blunt timing measurements as a temporary control

bash

# Example WAF rate limit rule (nginx) to slow ERC enumeration
limit_req_zone $binary_remote_addr zone=liferay_obj:10m rate=5r/s;

location /o/c/ {
    limit_req zone=liferay_obj burst=10 nodelay;
    proxy_pass http://liferay_backend;
}