CVE-2025-62266: Liferay DXP SSRF Vulnerability

CVE-2025-62266 Overview

CVE-2025-62266 is an open redirect vulnerability [CWE-601] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). By default, the affected products validate redirect URL security based on IP address rather than domain, exposing them to DNS rebinding attacks. Remote attackers can leverage this weakness to redirect authenticated users to arbitrary external URLs after user interaction such as clicking a crafted link. The flaw impacts Liferay Portal versions 7.4.0 through 7.4.3.119 along with older unsupported releases, and multiple Liferay DXP release trains including 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92.

Critical Impact
Attackers can chain DNS rebinding with Liferay's IP-based redirect validation to bypass allowlists and route trusted users to attacker-controlled destinations for phishing or credential theft.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.119 and older unsupported versions
Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92 and older unsupported versions

Discovery Timeline

2025-10-30 - CVE-2025-62266 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62266

Vulnerability Analysis

The vulnerability is classified under [CWE-601] (URL Redirection to Untrusted Site, also known as Open Redirect). Liferay's default configuration verifies whether a redirect target is safe by resolving the URL's hostname to an IP address and comparing that IP against a permitted set. This validation pattern is inherently susceptible to DNS rebinding, where an attacker-controlled domain returns different IP addresses across successive DNS queries.

Because the security check evaluates the resolved IP once, an attacker can serve a permitted IP during validation and a malicious IP or hostname on the follow-up request. The user is then redirected to an arbitrary external URL while trusting the originating Liferay domain. Exploitation requires user interaction, and the confidentiality and integrity impact is limited to low, consistent with a phishing-oriented redirect primitive.

Root Cause

The root cause is Liferay's default redirect URL security mode being set to IP-based validation. IP resolution is non-deterministic across time, so any allowlist keyed on the resolved address can be circumvented by a DNS rebinding server that returns a whitelisted IP during validation and swaps it for an attacker IP or unrelated hostname on the redirect.

Attack Vector

The attack is delivered over the network and requires only that a targeted user click a crafted link containing a redirect parameter pointing to an attacker-controlled domain. The attacker's authoritative DNS server responds with an approved IP for the first lookup performed by the Liferay redirect validator, then returns a different address for subsequent requests. Liferay accepts the redirect as safe and forwards the browser to the attacker's destination. Consult the Liferay Security Advisory for further vendor detail on the redirect validation flow.

Detection Methods for CVE-2025-62266

Indicators of Compromise

Outbound HTTP 302 responses from Liferay that include redirect, redirectURL, or p_l_back_url parameters resolving to external domains not on an approved list.
Repeated DNS lookups for the same hostname from the Liferay JVM with rapidly changing A-record responses within a short TTL window.
User reports of being redirected from a legitimate Liferay URL to unfamiliar external login or download pages.

Detection Strategies

Inspect Liferay access logs for redirect parameters containing external hostnames and correlate against expected domains.
Instrument DNS resolver logs to flag hostnames returning multiple distinct IPs, especially where private/allowlisted IPs alternate with public addresses.
Deploy web proxy or WAF rules that decode and evaluate redirect query parameters before the request reaches Liferay.

Monitoring Recommendations

Baseline the set of external domains legitimately referenced in Liferay redirect flows and alert on deviations.
Track user-agent redirect chains through egress proxies to identify Liferay-originated redirects landing on newly registered domains.
Aggregate Liferay application logs into a centralized analytics platform to enable retrospective hunting for DNS rebinding patterns.

How to Mitigate CVE-2025-62266

Immediate Actions Required

Change the Liferay redirect URL security mode from IP-based validation to domain-based validation, as recommended by the vendor.
Review and tighten the list of allowed redirect domains to only those required by business workflows.
Audit existing redirect parameters and portlet configurations for use of untrusted external hostnames.

Patch Information

Liferay tracks this issue on its known vulnerabilities portal. Refer to the Liferay Security Advisory for supported version guidance and update paths for Liferay Portal 7.4.x and Liferay DXP 2023.Q3, 2023.Q4, 2024.Q1, and 7.4 GA update streams.

Workarounds

Switch the redirect.url.security.mode configuration property from ip to domain to eliminate the DNS rebinding bypass.
Restrict outbound egress from the Liferay application server so redirect validation cannot resolve arbitrary external hostnames.
Enforce user awareness controls and warning interstitials for any redirect that leaves the primary Liferay domain.

bash

# portal-ext.properties: enforce domain-based redirect validation
redirect.url.security.mode=domain
redirect.url.domains.allowed=example.com,partner.example.net
redirect.url.ips.allowed=