CVE-2025-43795: Liferay DXP Open Redirect Vulnerability

CVE-2025-43795 Overview

CVE-2025-43795 is an open redirect vulnerability [CWE-601] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in three administrative portlets: System Settings, Instance Settings, and Site Settings. Remote attackers can craft URLs containing malicious redirect parameters that forward authenticated users to arbitrary external destinations. Affected releases include Liferay Portal 7.1.0 through 7.4.3.101 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, plus older unsupported versions. The issue supports phishing campaigns by leveraging the trusted Liferay domain to disguise attacker-controlled landing pages.

Critical Impact
Attackers can abuse the trusted Liferay origin to redirect victims to attacker-controlled sites, enabling credential harvesting and malware delivery through convincing phishing lures.

Affected Products

Liferay Portal 7.1.0 through 7.4.3.101
Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35
Older unsupported Liferay Portal and DXP releases

Discovery Timeline

2025-09-12 - CVE-2025-43795 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43795

Vulnerability Analysis

The vulnerability is a classic URL redirection to untrusted site issue [CWE-601]. Three separate administrative portlets accept a redirect parameter that is not validated against an allowlist of trusted destinations. The affected parameters are _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect, _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect, and _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect.

When a user interacts with a URL containing an attacker-controlled value for any of these parameters, the portlet issues an HTTP redirect to the supplied location. Because the redirect originates from the legitimate Liferay host, common indicators such as hovering over the link reveal a trusted domain, increasing the likelihood that victims will follow the redirect.

Root Cause

The root cause is missing or insufficient validation of the redirect request parameter across the System Settings, Instance Settings, and Site Settings portlets. The application accepts external absolute URLs rather than restricting redirects to same-origin paths or a vendor-defined allowlist.

Attack Vector

Exploitation requires user interaction. An attacker constructs a URL pointing to the target Liferay instance and appends one of the vulnerable redirect parameters set to an external URL. The attacker then delivers the crafted link via email, chat, or web content. When the victim clicks the link, the Liferay server processes the request and issues a redirect to the attacker-supplied location. See the Liferay Security Advisory CVE-2025-43795 for details.

Detection Methods for CVE-2025-43795

Indicators of Compromise

Web server access logs containing requests with _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect, _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect, or _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameters set to external absolute URLs.
HTTP 302 responses from Liferay endpoints whose Location header points to domains outside the organization's trusted list.
Referrer telemetry from user endpoints showing navigation from a Liferay host directly to a low-reputation or newly registered domain.

Detection Strategies

Parse HTTP access logs for the three vulnerable redirect parameter names and flag values containing http://, https://, or protocol-relative // prefixes pointing to non-corporate hosts.
Alert on outbound HTTP 3xx responses from Liferay where the Location header host does not match the internal domain allowlist.
Correlate email gateway telemetry with proxy logs to identify inbound phishing lures that reference the Liferay portal URL with a redirect parameter.

Monitoring Recommendations

Ingest Liferay web-tier access logs and proxy logs into a centralized SIEM to run continuous queries for open redirect patterns.
Monitor endpoint browser telemetry for redirect chains originating at the Liferay domain and terminating at newly seen external hosts.
Track authentication anomalies, such as credential reuse or password reset spikes, following any confirmed redirect abuse.

How to Mitigate CVE-2025-43795

Immediate Actions Required

Apply the fixes referenced in the Liferay Security Advisory CVE-2025-43795 to all Liferay Portal and DXP instances in scope.
Inventory Liferay deployments and confirm versions against the affected ranges, prioritizing internet-exposed portals.
Notify end users and administrators about phishing campaigns that may abuse the trusted Liferay domain during the remediation window.

Patch Information

Liferay has published guidance and fix availability in the vendor advisory. Administrators should upgrade Liferay Portal beyond 7.4.3.101 and apply the latest available updates for Liferay DXP 2023.Q3, 7.4, and 7.3 branches as listed by the vendor. Consult the Liferay Security Advisory CVE-2025-43795 for the current fixed versions and upgrade path.

Workarounds

Deploy a reverse proxy or WAF rule that strips or validates the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect, _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect, and _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameters against an internal host allowlist.
Block HTTP responses from Liferay whose Location header targets external hosts until the patch is applied.
Restrict administrative portlet access to authenticated administrators over trusted networks or VPN to reduce phishing exposure.

bash

# Example nginx rule to reject external redirect values on vulnerable parameters
if ($args ~* "(SystemSettingsPortlet_redirect|InstanceSettingsPortlet_redirect|SiteSettingsPortlet_redirect)=https?%3A%2F%2F(?!yourdomain\.com)") {
    return 400;
}