CVE-2024-25608: 
Java vulnerability analysis and mitigation

CVE-2024-25608 is an open redirect vulnerability affecting Liferay Portal versions 7.2.0 through 7.4.3.18 and Liferay DXP versions 7.4 (before update 19), 7.3 (before update 4), 7.2 (before fix pack 19), and older unsupported versions. The vulnerability was discovered and disclosed on February 20, 2024, with a CVSS v3.1 base score of 6.1 (Medium) (Liferay Advisory).

The vulnerability exists in the HtmlUtil.escapeRedirect function, which can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD). This allows remote attackers to bypass security controls and redirect users to arbitrary external URLs through various parameters including 'redirect', 'FORWARD_URL', 'noSuchEntryRedirect', and other parameters that rely on HtmlUtil.escapeRedirect. The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and no required privileges (NVD).

The vulnerability enables attackers to bypass secure email gateways (SEGs) and redirect users to malicious external websites. Over 77% of observed open redirects exploited the 'noSuchEntryRedirect' parameter, making it a significant attack vector. The vulnerability has been particularly impactful in phishing campaigns targeting government domains (Security Online, GB Hackers).

The vulnerability has been patched in Liferay Portal version 7.4.3.19, Liferay DXP 7.4 update 19, Liferay DXP 7.3 update 4, and Liferay DXP 7.2 fix pack 19. Organizations are advised to upgrade to these fixed versions to mitigate the risk (Liferay Advisory).

The vulnerability has gained significant attention due to its exploitation in government domain abuse. A Cofense Intelligence report highlighted that while U.S. government domains accounted for only 9% of exploited domains, they were the third most-targeted globally. The security community has expressed particular concern about the vulnerability's role in bypassing trusted domain verification mechanisms (Security Online).