CVE-2024-25608: Liferay Portal and DXP's HtmlUtil.escapeRedirect Vulnerability Allows Redirect Circumvention
Summary
CVE-2024-25608: Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character. Affects com.liferay.portal:release.portal.bom versions >= 7.2.0, < 7.4.3.19-ga19. Fixed in 7.4.3.19-ga19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for developers to create customizable solutions for various business needs. Liferay DXP (Digital Experience Platform) extends these capabilities with additional features for enterprise-level applications. However, certain versions of Liferay Portal and DXP have a vulnerability in the HtmlUtil.escapeRedirect function, which can be exploited to redirect users to arbitrary external URLs.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'REPLACEMENT CHARACTER' (U+FFFD) in the HtmlUtil.escapeRedirect method. This flaw allows remote attackers to manipulate redirect parameters such as 'redirect', 'FORWARD_URL', and 'noSuchEntryRedirect' to redirect users to malicious sites. The affected versions include Liferay Portal from 7.2.0 to 7.4.3.18 and Liferay DXP versions prior to specific updates. The potential ramifications include phishing attacks and unauthorized access to sensitive information.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.19-ga19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, validate and sanitize all redirect parameters in your application to prevent unauthorized redirects. Ensure that any user-supplied input is properly encoded and does not contain the U+FFFD character.
Conclusion
CVE-2024-25608 presents a significant risk to users of Liferay Portal and DXP due to its ability to allow unauthorized redirects. It is crucial for users to update their systems to the latest patched versions to mitigate this vulnerability and protect their applications from potential attacks.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-25608 is a vulnerability in Liferay Portal and DXP that allows attackers to circumvent the HtmlUtil.escapeRedirect function, potentially redirecting users to malicious sites.
Affected versions include Liferay Portal from 7.2.0 to 7.4.3.18 and Liferay DXP versions prior to 7.2.10.fp19, 7.3.10.u4, and 7.4.13.u19.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The risks include phishing attacks, unauthorized access to sensitive information, and potential loss of user trust due to malicious redirects.
Update your Maven dependencies in the pom.xml file to the patched versions as specified in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
