CVE-2025-43809: Liferay DXP CSRF Vulnerability

CVE-2025-43809 Overview

CVE-2025-43809 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the server license registration page in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows remote attackers to register a server license via the orderUuid parameter by tricking an authenticated administrator into submitting a forged request. The vulnerability is tracked under CWE-352 and is documented in the Liferay Security Advisory CVE-2025-43809.

Critical Impact
Remote attackers can register an unauthorized server license on affected Liferay deployments by coercing an authenticated user into visiting a malicious page.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions
Liferay DXP 2023.Q4.0 through 2023.Q4.7, and 2023.Q3.1 through 2023.Q3.9
Liferay DXP 7.4 GA through update 92, and older unsupported versions

Discovery Timeline

2025-09-19 - CVE-2025-43809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43809

Vulnerability Analysis

The vulnerability resides in the server license registration workflow within Liferay Portal and Liferay DXP. The registration endpoint accepts an orderUuid parameter but does not validate that the request originates from a legitimate, intentional user action. As a result, a remote attacker can craft a malicious HTML page or link that, when visited by an authenticated administrator, causes the browser to submit a state-changing request to the Liferay server. The affected functionality registers a server license on behalf of the victim without their consent.

Because license registration is an administrative operation, unauthorized invocation can alter licensing state and impact the operational integrity of the platform. The current EPSS probability is 0.169%, reflecting a low predicted exploitation likelihood at this time.

Root Cause

The root cause is a missing or insufficient anti-CSRF protection on the server (license) registration handler. The endpoint processes the orderUuid parameter without verifying a per-session CSRF token or enforcing an equivalent same-origin check. Any browser session with valid authentication cookies can be leveraged by an attacker-controlled page to submit the request.

Attack Vector

Exploitation requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or embedded request targeting the vulnerable Liferay license registration URL with an orderUuid value under the attacker's control. When an authenticated Liferay administrator visits the page, the browser transmits their session cookies alongside the forged request, causing the server to accept and process the license registration.

The vulnerability is described in prose only; no verified proof-of-concept code is publicly available. Refer to the Liferay Security Advisory CVE-2025-43809 for vendor technical details.

Detection Methods for CVE-2025-43809

Indicators of Compromise

Unexpected server license registration events in Liferay administrative audit logs referencing unfamiliar orderUuid values.
HTTP requests to the license registration endpoint containing Referer or Origin headers pointing to external, untrusted domains.
License state changes on the Liferay instance that do not correspond to a scheduled administrative action.

Detection Strategies

Enable and review Liferay audit logging for administrative actions, focusing on license registration operations and correlating them with authenticated user sessions.
Inspect reverse proxy or web application firewall (WAF) logs for POST requests to license registration paths that carry cross-origin Referer headers.
Correlate administrator browser activity with license registration timestamps to identify events triggered without a corresponding admin console navigation.

Monitoring Recommendations

Alert on any license registration action performed outside approved change windows or by unexpected admin accounts.
Monitor for repeated failed or successful requests to the license registration endpoint from user-agents typical of embedded browser sessions.
Track outbound administrator web activity to sites hosting suspicious HTML forms targeting Liferay endpoints.

How to Mitigate CVE-2025-43809

Immediate Actions Required

Apply the security patches provided by Liferay for Portal and DXP as identified in the vendor advisory.
Restrict access to the Liferay administrative interface to trusted networks or VPN-bound sessions to reduce browser exposure to malicious pages.
Require administrators to use isolated browsers or dedicated privileged access workstations when managing Liferay instances.

Patch Information

Liferay has published fix guidance in the Liferay Security Advisory CVE-2025-43809. Administrators of Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0–2023.Q4.7, 2023.Q3.1–2023.Q3.9, and 7.4 GA through update 92 should upgrade to the fixed releases identified by the vendor. Older unsupported versions remain vulnerable and should be upgraded to a supported release.

Workarounds

Enforce strict SameSite=Strict or SameSite=Lax cookie attributes on Liferay session cookies to limit cross-site request submission.
Deploy WAF rules that reject requests to the license registration endpoint when Origin or Referer headers do not match the Liferay host.
Terminate administrative sessions promptly after license or configuration workflows to reduce the window in which CSRF requests can succeed.

bash

# Example WAF rule concept: reject cross-origin POSTs to the license registration path
# Pseudocode - adapt to your WAF syntax
if request.method == "POST" and request.path contains "/license" and
   request.headers["Origin"] not in ["https://liferay.example.com"]:
    action: block
    log: "Potential CVE-2025-43809 CSRF attempt"