CVE-2025-62242: Liferay DXP Auth Bypass Vulnerability

CVE-2025-62242 Overview

CVE-2025-62242 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the AccountEntriesAdminPortlet component, where the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter is not properly validated against the authenticated user's account scope. Remote authenticated users can manipulate the addressId parameter to view address records belonging to other accounts. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated users in multi-tenant Liferay deployments can enumerate and disclose address information from accounts they do not own, breaching data isolation between tenants.

Affected Products

• Liferay Portal 7.4.3.4 through 7.4.3.111
• Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
• Liferay DXP 7.4 GA through update 92

Discovery Timeline

• 2025-10-13 - CVE-2025-62242 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62242

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the account administration portlet. When a user requests an address resource, the Liferay backend accepts the client-supplied addressId without verifying that the authenticated user has permission to read the address belonging to the referenced account.

In multi-tenant Liferay environments, each account scope should restrict address visibility to users assigned to that account. The flawed logic treats the identifier as trusted input and returns the referenced record. An attacker who legitimately belongs to Account A can submit identifiers from Account B and receive the address data stored under that account.

Exposed address data can include street address, city, region, postal code, country, and address metadata. In regulated environments this exposure may constitute a reportable data protection incident.

Root Cause

The root cause is reliance on a user-controlled key for object retrieval without a corresponding permission check. The portlet action handling the address lookup performs object loading before confirming that the subject's effective permissions include read access to the parent account entry.

Attack Vector

Exploitation is remote and requires a valid authenticated session with low privileges. An attacker authenticates to the Liferay instance, opens the account administration workflow, and intercepts a legitimate address request. The attacker then iterates numeric or UUID values in the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter to enumerate addresses tied to accounts they do not belong to. No special tooling is required beyond an HTTP interception proxy. The vulnerability does not provide write or deletion access to the records, limiting impact to confidentiality.

Detection Methods for CVE-2025-62242

Indicators of Compromise

• Repeated HTTP requests to the account administration portlet with sequential or varied addressId parameter values from a single session.
• Access patterns where one authenticated user retrieves address records associated with multiple distinct account IDs within a short window.
• Portlet responses returning HTTP 200 for addressId values that do not correlate to the user's assigned accounts in Liferay audit logs.

Detection Strategies

• Enable Liferay audit logging for the AccountEntriesAdminPortlet and correlate addressId access against the user's account membership.
• Deploy web application firewall (WAF) rules that flag high-rate parameter iteration on _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId.
• Review reverse proxy logs for enumeration patterns: large numbers of requests to the account admin endpoint from one session with changing identifier values.

Monitoring Recommendations

• Forward Liferay application logs and access logs to a centralized analytics platform and alert on anomalous address lookup volumes per user.
• Baseline normal account administrator behavior and alert when non-administrator users query address records from accounts outside their membership.
• Monitor outbound data transfers from the Liferay node for atypical response sizes tied to account administration endpoints.

How to Mitigate CVE-2025-62242

Immediate Actions Required

• Inventory all Liferay Portal and DXP instances and compare installed versions against the affected ranges listed above.
• Apply the fixes referenced in the Liferay security advisory as the primary remediation.
• Restrict access to the account administration portlet to trusted administrators until patching is complete.
• Rotate or review access for any user accounts suspected of enumeration activity.

Patch Information

Liferay has published remediation guidance in its security advisory. Upgrade Liferay Portal to a release later than 7.4.3.111, and upgrade Liferay DXP to a release later than 2023.Q4.5, 2023.Q3.8, or 7.4 update 92, depending on the deployed branch. Confirm the fix applies to the AccountEntriesAdminPortlet authorization path before placing the system back into production. See the Liferay CVE-2025-62245 Advisory for version mapping.

Workarounds

• Temporarily remove non-administrative users from any role that grants access to the account entries administration portlet.
• Configure a WAF or reverse proxy rule to block requests to the account admin portlet from users whose session identity does not match an administrator group.
• Audit account entry permissions and enforce least privilege on roles that touch the account administration surface area.

# Example WAF rule concept blocking non-admin access to the vulnerable portlet
# Pseudocode - adapt to your WAF syntax (ModSecurity, F5, AWS WAF, etc.)
SecRule REQUEST_URI "@contains _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId" \
  "id:1062242,phase:2,deny,status:403,msg:'Block IDOR enumeration attempt on Liferay account addresses',\
   chain"
  SecRule REQUEST_HEADERS:Cookie "!@rx ROLE=Administrator"