CVE-2025-4655 Overview
CVE-2025-4655 is a Server-Side Request Forgery (SSRF) vulnerability affecting FreeMarker templates in Liferay Portal and Liferay Digital Experience Platform (DXP). Template editors can bypass access validations by supplying crafted URLs, causing the server to issue requests to attacker-chosen destinations. The flaw is classified under [CWE-918]. Exploitation requires an authenticated user with template editing privileges, which limits the attack population but does not eliminate risk in environments with distributed content authoring.
Critical Impact
Authenticated template editors can force the Liferay server to make outbound HTTP requests to arbitrary URLs, enabling reconnaissance of internal networks and interaction with metadata services or internal-only endpoints.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15
- Liferay DXP 7.4 GA through update 92
Discovery Timeline
- 2025-08-09 - CVE-2025-4655 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4655
Vulnerability Analysis
The vulnerability resides in how FreeMarker templates in Liferay Portal and DXP handle URL processing. Liferay applies access validation to restrict which URLs a template can reach, but the validation logic can be bypassed with specially crafted URL inputs. When bypass succeeds, the server-side template engine issues an outbound request to the attacker-controlled destination.
Because the request originates from the Liferay server, it inherits the server's network position. Attackers can probe internal services, reach cloud instance metadata endpoints, or interact with administrative interfaces that are not exposed externally. The result is disclosure of network structure and potential lateral access to internal HTTP services.
Exploitation requires high privileges: only users authorized to edit FreeMarker templates can trigger the flaw. The scope of impact remains limited to confidentiality of adjacent systems reachable from the Liferay host.
Root Cause
The root cause is insufficient validation of URL inputs consumed by FreeMarker template directives. Access-control checks intended to constrain outbound requests can be evaded by URLs that encode or structure the destination in a way the validator does not normalize.
Attack Vector
An authenticated user with template editor rights authors or modifies a FreeMarker template that constructs a URL crafted to bypass Liferay's URL access validation. When the template renders, the Liferay server performs an outbound request to the attacker-specified target and returns response data or timing information usable for internal reconnaissance.
// No verified exploit code is publicly available for CVE-2025-4655.
// Refer to the Liferay Security Advisory for technical details.
Detection Methods for CVE-2025-4655
Indicators of Compromise
- Unexpected outbound HTTP or HTTPS connections originating from the Liferay JVM process to internal IP ranges, 169.254.169.254, or cloud metadata endpoints.
- FreeMarker template revisions authored or modified by low-trust editor accounts that include URL construction logic referencing internal hostnames.
- Access log entries showing template rendering requests followed by anomalous DNS lookups for internal or metadata domains.
Detection Strategies
- Audit Liferay template change history for edits by non-administrator accounts and review the URL patterns present in template source.
- Correlate Liferay application logs with egress firewall logs to identify template rendering events that produced outbound requests to non-approved destinations.
- Deploy egress filtering rules that alert when the Liferay host contacts private address space or cloud metadata IPs.
Monitoring Recommendations
- Enable verbose logging on FreeMarker template execution and forward events to a centralized SIEM for retention and correlation.
- Monitor authentication and role-assignment logs for unexpected grants of template editor privileges.
- Alert on any request from the Liferay server to 169.254.169.254, metadata.google.internal, or equivalent cloud metadata endpoints.
How to Mitigate CVE-2025-4655
Immediate Actions Required
- Apply the fixed releases published in the Liferay Security Advisory CVE-2025-4655.
- Review and reduce the set of users assigned template editor roles to the minimum required for business operations.
- Restrict outbound network access from Liferay servers using host-based firewall rules or network egress controls.
Patch Information
Liferay has published fixes for affected releases of Liferay Portal 7.4 and Liferay DXP quarterly and update branches. Consult the Liferay Security Advisory CVE-2025-4655 for the specific fixed version corresponding to each affected release train and follow the vendor's upgrade procedure.
Workarounds
- Restrict template editor permissions to trusted administrators until patches are applied.
- Block outbound HTTP and HTTPS traffic from the Liferay server to internal subnets and cloud metadata endpoints via network policy.
- Enforce an allowlist of external hostnames the Liferay server may contact for template-driven integrations.
# Example egress restriction using iptables to block cloud metadata endpoint
iptables -A OUTPUT -m owner --uid-owner liferay -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner liferay -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -m owner --uid-owner liferay -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
