CVE-2025-4604: Liferay DXP Captcha Bypass Vulnerability

CVE-2025-4604 Overview

CVE-2025-4604 is a CAPTCHA bypass vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows authenticated attackers to circumvent the CAPTCHA verification check and execute scripts through the Gogo shell, an OSGi administrative console exposed by the platform. The vulnerability is classified under [CWE-79] and impacts multiple release branches, including Liferay Portal 7.4.3.80 through 7.4.3.132 and Liferay DXP 2024.Q1 through 2025.Q1 releases, along with 7.4 update 80 through update 92.

Critical Impact
Authenticated attackers can bypass CAPTCHA protections and execute scripts through the Gogo shell, enabling administrative-level access to OSGi runtime commands.

Affected Products

Liferay Portal 7.4.3.80 through 7.4.3.132
Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, and 2025.Q1.0 through 2025.Q1.15
Liferay DXP 7.4 update 80 through update 92

Discovery Timeline

2025-08-04 - CVE-2025-4604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4604

Vulnerability Analysis

The vulnerability resides in the CAPTCHA validation logic used by Liferay Portal and Liferay DXP. Attackers with low-privilege authenticated access can bypass the CAPTCHA check that gates certain sensitive functionality. Once the check is bypassed, the attacker can reach the Gogo shell script execution surface. The Gogo shell is an OSGi-based administrative interface used to manage bundles, run scripts, and interact with the underlying Java runtime.

The Common Weakness Enumeration classification is [CWE-79], indicating an issue in how untrusted input is processed and reflected during the challenge-response flow. Successful exploitation carries high confidentiality impact and can escalate into broader compromise of the portal environment.

Root Cause

The root cause is improper enforcement of the CAPTCHA verification path. The vulnerable code accepts requests that should have been rejected by the challenge, allowing attackers to submit requests that trigger sensitive administrative operations without completing the intended human-verification workflow.

Attack Vector

Exploitation requires network access to the Liferay Portal instance, low-privilege authentication, and user interaction as reflected in the CVSS 4.0 vector. An attacker crafts HTTP requests targeting the affected endpoint, circumvents the CAPTCHA gate, and then submits Gogo shell script commands. Because the Gogo shell exposes OSGi runtime capabilities, script execution translates directly into control over portal components.

No verified public proof-of-concept exploit is available. See the Liferay Security Advisory CVE-2025-4604 for vendor technical details.

Detection Methods for CVE-2025-4604

Indicators of Compromise

Unexpected HTTP requests to Gogo shell endpoints (typically under /o/ or telnet port 11311 on the Felix Gogo service) originating from low-privilege user sessions.
Application logs showing successful requests to CAPTCHA-protected forms without corresponding challenge validation entries.
OSGi bundle installation, modification, or script execution events tied to non-administrative accounts.

Detection Strategies

Correlate authentication logs with CAPTCHA validation events to identify sessions that reached protected endpoints without a completed challenge.
Alert on any Gogo shell command execution outside of documented administrative maintenance windows.
Monitor Liferay audit logs for anomalous script submission activity, particularly Groovy or Beanshell payloads submitted by non-admin roles.

Monitoring Recommendations

Enable verbose logging on the com.liferay.captcha and OSGi Gogo shell components to capture request-level context.
Forward Liferay application, access, and audit logs to a centralized SIEM for retention and correlation.
Baseline normal administrative activity so deviations against the Gogo shell endpoint trigger investigation.

How to Mitigate CVE-2025-4604

Immediate Actions Required

Upgrade Liferay Portal to a fixed release above 7.4.3.132 and Liferay DXP to a patched quarterly release beyond 2025.Q1.15 as directed by the vendor advisory.
Restrict network exposure of the Gogo shell to trusted administrative networks only, and never expose it to the public internet.
Review authentication and audit logs for evidence of prior exploitation attempts against CAPTCHA-protected endpoints.

Patch Information

Liferay has published patch guidance in the Liferay Security Advisory CVE-2025-4604. Administrators should consult the advisory for exact fixed versions corresponding to their DXP quarterly release train or Portal branch and apply the vendor-supplied fix pack.

Workarounds

Disable the Gogo shell service if it is not required for operations, or bind it exclusively to localhost.
Enforce least-privilege role assignments so that low-tier authenticated users cannot reach administrative endpoints.
Place the Liferay instance behind a reverse proxy or web application firewall that filters and rate-limits requests to CAPTCHA-protected forms.

bash

# Restrict Gogo shell to localhost in portal-ext.properties
module.framework.properties.osgi.console=127.0.0.1:11311

# Disable the Gogo shell entirely if not needed
module.framework.services.ignored=org.apache.felix.gogo.command,\
  org.apache.felix.gogo.runtime,\
  org.apache.felix.gogo.shell