CVE-2025-43803: Liferay DXP IDOR Vulnerability

CVE-2025-43803 Overview

CVE-2025-43803 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Contacts Center widget shipped with Liferay Portal and Liferay Digital Experience Platform (DXP). Remote, unauthenticated attackers can enumerate contact records by manipulating the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter. Successful exploitation exposes contact names and email addresses stored in the widget. The flaw affects Liferay Portal 7.4.0 through 7.4.3.119 and multiple Liferay DXP branches, including 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92.

Critical Impact
Unauthenticated remote attackers can harvest contact names and email addresses from vulnerable Liferay instances by iterating a single request parameter, enabling downstream phishing and reconnaissance campaigns.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.119 (and older unsupported versions)
Liferay DXP 2023.Q4.0 through 2023.Q4.6 and 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92 (and older unsupported versions)

Discovery Timeline

2025-09-19 - CVE-2025-43803 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-43803

Vulnerability Analysis

The Contacts Center widget renders individual contact entries based on the entryId value supplied in the portlet request. The application resolves the referenced entry and returns contact metadata without verifying that the requesting user has authorization to view that record. As a result, an attacker can substitute arbitrary numeric identifiers into the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter and retrieve contact data belonging to other users. Returned data includes the contact's name and email address. Because the request requires no authentication and no user interaction, the flaw is trivial to script for bulk enumeration.

Root Cause

The root cause is missing object-level authorization inside the Contacts Center portlet handler. The code trusts client-supplied identifiers and performs a lookup against contact storage without confirming ownership or permission. This pattern maps directly to CWE-639: Authorization Bypass Through User-Controlled Key. Liferay's permission framework was not consulted before returning the entry payload.

Attack Vector

Exploitation is performed over the network against any Liferay page hosting the Contacts Center widget. An attacker issues HTTP requests to the portlet endpoint and increments the entryId value across a numeric range. Each response leaks the corresponding contact's name and email if the entry exists. No credentials, tokens, or user interaction are required. See the Liferay Security Advisory CVE-2025-43803 for vendor-supplied technical detail.

Detection Methods for CVE-2025-43803

Indicators of Compromise

Repeated HTTP requests to portlet URLs containing _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId with sequential or incrementing numeric values.
High-volume unauthenticated access to pages hosting the Contacts Center widget from a single source IP or a narrow range of IPs.
Web server access logs showing anomalous 200-OK responses to Contacts Center portlet requests originating outside typical business hours.

Detection Strategies

Parse Liferay access logs for the entryId parameter and alert when a single client requests more than a defined threshold of distinct values within a short window.
Deploy a Web Application Firewall (WAF) rule that flags rapid enumeration patterns against the Contacts Center portlet URL.
Correlate outbound phishing indicators (spike in emails to harvested addresses) with prior portlet access to identify post-exploitation activity.

Monitoring Recommendations

Forward Liferay HTTP access logs and application logs to a centralized SIEM for retention and query.
Baseline normal request volume to the Contacts Center widget and alert on statistical deviations.
Monitor authentication state on requests hitting contact-related portlets and investigate unauthenticated retrievals of entry data.

How to Mitigate CVE-2025-43803

Immediate Actions Required

Inventory all Liferay Portal and DXP instances and identify versions in the affected ranges.
Apply the fixed release or hotfix published in the Liferay Security Advisory CVE-2025-43803.
Remove or disable the Contacts Center widget from public-facing pages until patching is complete.

Patch Information

Liferay has published remediation guidance in its security advisory portal. Administrators should upgrade Liferay Portal beyond 7.4.3.119 and apply the corresponding DXP updates for the 2023.Q4, 2023.Q3, and 7.4 update 92 branches. Refer to the Liferay Security Advisory CVE-2025-43803 for the specific fix version applicable to your deployment.

Workarounds

Restrict access to pages hosting the Contacts Center widget to authenticated users through Liferay permission settings.
Add a WAF rule to block or rate-limit unauthenticated requests containing the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.
Remove the Contacts Center widget from any guest-accessible pages if the widget is not required for business operations.

bash

# Example WAF rule (ModSecurity) to block unauthenticated enumeration
SecRule REQUEST_URI "@contains _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId" \
    "id:1004380,phase:1,deny,status:403,log,\
    msg:'Blocked Contacts Center IDOR enumeration attempt (CVE-2025-43803)',\
    chain"
    SecRule &REQUEST_COOKIES:JSESSIONID "@eq 0"