CVE-2025-62266: 
Java vulnerability analysis and mitigation

CVE-2025-62266 is a DNS rebinding vulnerability in Liferay Portal and Liferay DXP that allows remote attackers to redirect users to arbitrary external URLs. It affects Liferay Portal 7.4.0 through 7.4.3.119 (and older unsupported versions), and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 (and older unsupported versions). The vulnerability was published on October 30, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Liferay Security).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). By default, Liferay's redirect URL security mechanism validates redirect targets based on IP address rather than domain name, making it susceptible to DNS rebinding attacks where an attacker can manipulate DNS resolution to bypass IP-based allowlists and redirect users to attacker-controlled external URLs. Exploitation requires no privileges and no special attack conditions, but does require active user interaction (a victim must follow a crafted link or be redirected). The vendor notes this can be mitigated by changing the redirect URL security setting from IP-based to domain-based validation (GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to redirect authenticated or unauthenticated users from a trusted Liferay Portal or DXP instance to an arbitrary external URL of the attacker's choosing. The primary risks are phishing attacks, credential harvesting, and social engineering, as users may trust a redirect originating from a known Liferay portal. Confidentiality and integrity impacts are rated low, with no availability impact; subsequent system impact is also none, limiting the scope to the user's browser session (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62266. The EPSS score is approximately 0.043% (0.00143), placing it in the 14th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Liferay Portal or DXP instances running affected versions (Portal 7.4.0–7.4.3.119, DXP 7.4 GA–update 92, or quarterly releases through 2024.Q1.5) using tools like Shodan or Censys.
2. Craft DNS rebinding payload: Register a domain with a DNS server configured to initially resolve to the Liferay server's IP, then rapidly switch resolution to an attacker-controlled IP after the browser's DNS cache expires (TTL manipulation).
3. Construct malicious redirect URL: Create a URL targeting the Liferay portal's redirect functionality that references the attacker's domain, exploiting the IP-based (rather than domain-based) redirect validation to pass the allowlist check during initial resolution.
4. Deliver to victim: Distribute the crafted URL via phishing email, social media, or embedded links, enticing a user to click it while authenticated to the Liferay portal.
5. Redirect achieved: Once the victim's browser follows the redirect, DNS rebinding causes the request to resolve to the attacker's server, landing the user on a malicious external site (e.g., a credential-harvesting phishing page) (GitHub Advisory).

• Logs: Liferay access logs showing redirect requests to unexpected external domains or IP addresses; unusual patterns of redirect-related HTTP 302 responses to non-whitelisted destinations.
• Network: Outbound HTTP/HTTPS traffic from user browsers to unfamiliar external domains immediately following interaction with a Liferay portal redirect endpoint; DNS queries for attacker-controlled domains with very short TTLs originating from portal users.
• Application: Liferay portal logs recording redirect attempts to domains not in the configured allowlist, especially if redirect URL security is set to IP-based validation.

Liferay has released a patched version of Liferay Portal (7.4.3.110 and later). For Liferay DXP, administrators should apply the relevant quarterly or update releases beyond the affected ranges. As an immediate workaround without upgrading, administrators should change the redirect URL security setting from IP to domain in the Liferay portal configuration, which prevents DNS rebinding from bypassing redirect validation. Organizations running older unsupported versions should prioritize upgrading to a supported, patched release (GitHub Advisory, Liferay Security).