CVE-2025-62253: Liferay DXP Open Redirect Vulnerability

CVE-2025-62253 Overview

CVE-2025-62253 is an open redirect vulnerability [CWE-601] in the page administration component of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter, which fails to validate user-supplied URLs before performing a redirect. Remote attackers can craft URLs that appear to originate from a trusted Liferay instance but redirect victims to arbitrary external destinations. This behavior enables phishing campaigns, credential harvesting, and drive-by download attacks that leverage the legitimacy of the Liferay host domain.

Critical Impact
Attackers can abuse trusted Liferay URLs to redirect authenticated or unauthenticated users to attacker-controlled sites without any user interaction beyond clicking a link.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4
Liferay DXP 7.4 GA through update 92, and 7.3 GA through update 35

Discovery Timeline

2025-10-27 - CVE-2025-62253 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62253

Vulnerability Analysis

The vulnerability exists in the GroupPagesPortlet component of Liferay's page administration module. Liferay uses a redirect request parameter to return users to a previous location after certain administrative actions. In affected versions, the portlet accepts arbitrary values for _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect and issues an HTTP redirect without confirming the destination is within the same origin.

Open redirects are frequently chained with phishing operations. Because the initial URL points to a legitimate Liferay Portal host, email gateways and users are less likely to flag it as suspicious. Once the victim's browser follows the redirect, the request lands on an attacker-controlled domain that can serve a cloned login page or malware payload.

Root Cause

The root cause is missing destination validation in the redirect handling logic. The portlet does not compare the target URL against an allowlist of trusted internal paths, nor does it enforce that the redirect must be a relative URL. Any absolute URL, including http:// and https:// schemes pointing to external hosts, is accepted.

Attack Vector

Exploitation requires no authentication and no privileges. An attacker crafts a URL that references the vulnerable Liferay endpoint and sets the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter to an external URL. The victim receives the link through email, chat, or a compromised website. When clicked, the Liferay server responds with an HTTP redirect to the attacker's destination.

No verified public exploit code is available for CVE-2025-62253. Refer to the Liferay CVE-2025-62253 Vulnerability Notice for vendor details.

Detection Methods for CVE-2025-62253

Indicators of Compromise

HTTP requests to Liferay endpoints containing _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect with values referencing external domains
Web server access logs showing 302 or 303 responses to off-domain URLs originating from the page administration portlet
Unusual referrer chains where users arrive at external phishing pages via a Liferay host

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for redirect parameter values that resolve outside the organization's trusted domain list
Configure URL parameter analysis to flag absolute URLs submitted to the GroupPagesPortlet redirect parameter
Correlate outbound clicks from Liferay hosts with threat intelligence feeds identifying phishing and malware domains

Monitoring Recommendations

Enable verbose logging on the Liferay portlet request pipeline to capture redirect parameter values
Alert on user reports of unexpected redirects from Liferay-hosted pages
Monitor DNS queries generated by internal users immediately after Liferay portal sessions for anomalous external hostnames

How to Mitigate CVE-2025-62253

Immediate Actions Required

Apply the security fix documented in the Liferay CVE-2025-62253 Vulnerability Notice to all Liferay Portal and DXP instances
Upgrade Liferay Portal to a version newer than 7.4.3.97 or apply the applicable DXP update beyond 7.4 update 92 or 7.3 update 35
Review Liferay access logs for prior exploitation attempts targeting the GroupPagesPortlet redirect parameter

Patch Information

Liferay has published a security advisory and remediation guidance at the Liferay CVE-2025-62253 Vulnerability Notice. Customers on supported release trains should upgrade to the latest quarterly or update release. Organizations running unsupported Liferay versions must migrate to a supported branch, since backports are not provided.

Workarounds

Deploy a WAF rule that rejects or sanitizes requests where the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter contains absolute URLs pointing to external hosts
Restrict redirect destinations at the reverse proxy layer to an allowlist of internal domains
Educate users about phishing links that begin with the organization's trusted Liferay domain but include suspicious redirect parameters

bash

# Example ModSecurity rule blocking external redirect targets
SecRule ARGS:_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect \
    "@rx ^(https?:)?//(?!trusted-liferay\.example\.com)" \
    "id:1006225,phase:2,deny,status:400,\
     msg:'CVE-2025-62253 external redirect blocked'"