CVE-2025-43767
📋 TL;DR
An open redirect vulnerability in Liferay Portal and DXP allows attackers to manipulate the /c/portal/edit_info_item parameter to redirect users to malicious websites. This affects Liferay Portal 7.4.3.86-7.4.3.131 and multiple DXP versions from 2024.Q1.1 through 2024.Q3.9. Users of affected versions who click on manipulated links are at risk.
💻 Affected Systems
- Liferay Portal
- Liferay DXP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to phishing sites that steal credentials or deliver malware, leading to account compromise, data theft, or ransomware infection.
Likely Case
Attackers use the redirect for phishing campaigns, tricking users into entering credentials on fake login pages or downloading malicious files.
If Mitigated
With proper user awareness training and URL validation controls, impact is limited to failed phishing attempts with minimal damage.
🎯 Exploit Status
Exploitation requires user interaction (clicking a link) and knowledge of the vulnerable parameter. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Liferay Portal 7.4.3.132+; Liferay DXP 2024.Q3.10+, 2024.Q2.14+, 2024.Q1.13+, 7.4 update 93+
Vendor Advisory: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43767
Restart Required: No
Instructions:
1. Download the appropriate patch from Liferay's customer portal. 2. Apply the patch according to Liferay's patching documentation. 3. Verify the fix by testing the redirect functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a servlet filter or security rule to validate and sanitize redirect URLs in the edit_info_item parameter.
Implement custom filter in web.xml or use security framework rules
WAF Rule
allConfigure Web Application Firewall to block requests containing suspicious redirect parameters.
Add WAF rule: Block requests with 'redirect' parameter containing external domains
🧯 If You Can't Patch
- Implement strict URL validation in application code to only allow relative URLs or trusted domains in redirect parameters.
- Deploy network-level controls to block outbound connections to untrusted domains from Liferay servers.
🔍 How to Verify
Check if Vulnerable:
Test by accessing /c/portal/edit_info_item?redirect=http://evil.com and checking if redirect occurs. Use a test domain you control.Check Version:
Check Liferay version via Control Panel → Configuration → Server Administration → System InformationVerify Fix Applied:
After patching, test the same redirect attempt - it should either be blocked or sanitized to a safe URL.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /c/portal/edit_info_item with external URLs in redirect parameter
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound connections from Liferay server to suspicious domains following redirects
SIEM Query:
source="liferay-logs" AND uri="/c/portal/edit_info_item" AND query="*redirect=*"