CVE-2024-25609: Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Vulnerability Allows URL Redirection
Summary
CVE-2024-25609: Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes. Affects com.liferay.portal:release.portal.bom versions >= 7.2.0, < 7.4.3.13-ga13. Fixed in 7.4.3.13-ga13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for creating dynamic websites and applications, with features such as user management, content management, and collaboration tools. Liferay DXP is the commercial version of Liferay Portal, offering additional enterprise features. The vulnerability in question affects the HtmlUtil.escapeRedirect function, which is intended to prevent open redirect attacks by sanitizing URLs. However, due to a flaw in its implementation, this function can be bypassed, allowing attackers to redirect users to malicious external sites.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2022-28977) in the HtmlUtil.escapeRedirect function. It can be exploited by using two forward slashes in the redirect URL, enabling remote attackers to redirect users to arbitrary external URLs. This poses a significant risk as it can lead to phishing attacks, data theft, and other malicious activities. The affected versions include Liferay Portal from 7.2.0 to 7.4.3.12 and Liferay DXP versions prior to update 9, as well as several older unsupported versions.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.13-ga13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the redirect functionality that relies on HtmlUtil.escapeRedirect until the package is updated. Additionally, validate and sanitize user inputs to prevent potential exploitation.
Conclusion
CVE-2024-25609 is a significant vulnerability affecting Liferay Portal and Liferay DXP, allowing attackers to exploit the HtmlUtil.escapeRedirect function. It is crucial to update to the patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-25609 is a vulnerability in Liferay Portal and Liferay DXP that allows attackers to bypass URL redirection protections, potentially leading to malicious redirects.
The vulnerability affects Liferay Portal versions from 7.2.0 to 7.4.3.12 and Liferay DXP versions prior to update 9, along with several older unsupported versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can help you determine if your application is affected by this vulnerability.
The vulnerability can lead to open redirect attacks, where users are redirected to malicious sites, potentially resulting in phishing, data theft, and other security issues.
If you believe your application has been compromised due to this vulnerability, report the incident to your security team immediately and follow your organization's incident response procedures.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
