CVE-2025-43789: Liferay DXP Authentication Bypass Vulnerability

CVE-2025-43789 Overview

CVE-2025-43789 affects the JSON Web Services (JWS) subsystem in Liferay Portal and Liferay Digital Experience Platform (DXP). JSON Web Services registered and invoked directly as classes bypass the intended enforcement path, allowing Service Access Policies to be executed in a manner not aligned with the vendor's authorization model. The issue is categorized as an authorization weakness [CWE-863]. It affects Liferay Portal versions 7.4.0 through 7.4.3.119 and Liferay DXP 2024.Q1.1 through 2024.Q1.9, as well as 7.4 GA through update 92 published to OSGi.

Critical Impact
An authenticated adjacent-network actor can trigger Service Access Policy execution by invoking JSON Web Services directly as classes, leading to limited confidentiality and integrity impact on the Liferay environment.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.119
Liferay DXP 2024.Q1.1 through 2024.Q1.9
Liferay DXP 7.4 GA through update 92 (OSGi-published)

Discovery Timeline

2025-09-12 - CVE-2025-43789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43789

Vulnerability Analysis

Liferay exposes backend Java services to remote consumers through the JSON Web Services (JWS) framework. Under normal operation, calls are routed through a service invoker that enforces Service Access Policies (SAPs) and remote-invocation restrictions before reaching the underlying method. The vulnerability arises because JWS endpoints are registered and invoked directly as classes rather than through the intended service dispatcher. As a result, Service Access Policies get executed on service paths that should be gated by the standard enforcement flow, producing behavior that deviates from the policy administrator's intent.

The issue is scoped to authorization logic rather than memory safety or injection. It requires an authenticated session with low privileges and adjacent-network access, and user interaction is a factor in exploitation.

Root Cause

The root cause is improper authorization [CWE-863] in the registration and dispatch path of JSON Web Services. Because services are handled as direct class invocations, the Service Access Policy layer is engaged on invocations that would otherwise be filtered or blocked by the standard JWS mediator. This produces incorrect authorization decisions for the affected endpoints.

Attack Vector

Exploitation requires an authenticated user on an adjacent network and some form of user interaction. The attacker crafts a request against a JWS endpoint that is registered as a direct class invocation. The request causes Service Access Policies to be executed on a path where they should not apply directly, producing limited confidentiality and integrity impact. There is no evidence of exploitation in the wild and no public proof-of-concept has been referenced by the vendor.

No verified public exploit code is available for CVE-2025-43789. Refer to the Liferay Security Advisory CVE-2025-43789 for vendor-authoritative technical details.

Detection Methods for CVE-2025-43789

Indicators of Compromise

Unexpected authenticated requests to /api/jsonws/ endpoints originating from internal or adjacent network segments.
Log entries showing JWS invocations resolving directly to class-level handlers rather than through the standard service dispatcher.
Anomalous invocation patterns against services normally restricted by Service Access Policies.

Detection Strategies

Compare Liferay build version against the fixed releases listed in the vendor advisory to identify exposed instances.
Correlate Liferay application logs with authentication events to identify low-privilege accounts issuing JWS calls to unusual service classes.
Baseline normal JWS usage per role and alert on deviations, particularly on endpoints tied to Service Access Policy enforcement.

Monitoring Recommendations

Forward Liferay application, access, and audit logs to a centralized SIEM for retention and correlation.
Monitor for repeated /api/jsonws calls following authentication from adjacent network ranges (VPN, internal subnets, partner networks).
Track configuration changes to Service Access Policies and alert on unexpected policy invocations.

How to Mitigate CVE-2025-43789

Immediate Actions Required

Inventory all Liferay Portal and DXP instances and confirm exact versions against the affected range.
Apply the fixes referenced in the Liferay Security Advisory CVE-2025-43789.
Restrict access to /api/jsonws and administrative interfaces to trusted networks and identities only.
Review Service Access Policy definitions to ensure they align with least-privilege intent.

Patch Information

Liferay has published guidance and fix information in its security advisory. Customers running Liferay Portal 7.4.0–7.4.3.119 should upgrade to a fixed release beyond 7.4.3.119. DXP customers on 2024.Q1.1–2024.Q1.9 should upgrade to the latest available quarterly release, and 7.4 GA–update 92 deployments should apply the corresponding OSGi update. Consult the vendor advisory for exact target versions and patching steps.

Workarounds

Limit JWS exposure by restricting /api/jsonws behind network access controls and authentication proxies.
Tighten Service Access Policies to explicitly deny remote invocation of internal service classes.
Enforce multi-factor authentication for portal users to raise the cost of the required authenticated access.
Segment Liferay servers away from general user networks to reduce the adjacent-network attack surface.

bash

# Example: restrict JSON Web Services endpoint at the reverse proxy (nginx)
location /api/jsonws {
    allow 10.0.10.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://liferay_backend;
}