Liferay DXP Server-Side Request Forgery Vulnerability in Domain Validation

A server-side request forgery (SSRF) vulnerability has been identified in Liferay DXP versions 2025.Q2.0 through 2025.Q2.3. The vulnerability arises from insecure domain validation on the 'analytics.cloud.domain.allowed' parameter, which allows attackers to manipulate the domain and bypass validation. This flaw does not differentiate between trusted subdomains and potentially harmful domains, enabling unauthorized requests to be made.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server perform requests on their behalf. This could potentially be used to access internal services or resources that are not normally exposed to the outside world.

Remediation

Users can upgrade to Liferay DXP 2025.Q2.4 to address this vulnerability. For those using Liferay Portal, the issue has been fixed in the master branch.