Description
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Liferay | Portal | 7.2.0 – ≤ 7.4.3.18 | — |
| Liferay | DXP | 7.4.13 – ≤ 7.4.13.u18, 7.3.10 – ≤ 7.3.10-dxp-3, 7.2.10 – ≤ 7.2.10-dxp-18 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Liferay Portal - Open Redirect http/cves/2024/CVE-2024-25608.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | < 7.2.10.fp19 | 7.2.10.fp19 | GHSA-548x-j6x6-hcv4 |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.3.0, < 7.3.10.u4 | 7.3.10.u4 | GHSA-548x-j6x6-hcv4 |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.4.0, < 7.4.13.u19 | 7.4.13.u19 | GHSA-548x-j6x6-hcv4 |
| Maven | com.liferay.portal:release.portal.bom | >= 7.2.0, < 7.4.3.19-ga19 | 7.4.3.19-ga19 | GHSA-548x-j6x6-hcv4 |
Advisories 1
- WID-SEC-2024-0428 Liferay Portal und DXP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2024