VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 20, 2024· Updated Aug 1, 2024

CVE-2024-25608

CVE-2024-25608

Description

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect parameter (2) FORWARD_URL parameter, (3) noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.2.0, < 7.4.3.19-ga197.4.3.19-ga19
com.liferay.portal:release.dxp.bomMaven
< 7.2.10.fp197.2.10.fp19
com.liferay.portal:release.dxp.bomMaven
>= 7.3.0, < 7.3.10.u47.3.10.u4
com.liferay.portal:release.dxp.bomMaven
>= 7.4.0, < 7.4.13.u197.4.13.u19

Affected products

2

Patches

2
36adf82ef7a0

LPS-144563 Add test

https://github.com/liferay/liferay-portalIstvan SajtosMar 25, 2022via ghsa
commit
1 file changed · +2 −0
  • portal-impl/test/unit/com/liferay/portal/util/PortalImplEscapeRedirectTest.java+2 −0 modified
    @@ -116,6 +116,8 @@ public void testEscapeRedirectWithDomains() throws Exception {
 		Assert.assertNull(_portalImpl.escapeRedirect(":@liferay.com"));
 		Assert.assertNull(_portalImpl.escapeRedirect("http:/web"));
 		Assert.assertNull(_portalImpl.escapeRedirect("http:web"));
+		Assert.assertNull(
+			_portalImpl.escapeRedirect("https://google.com\uFFFD@localhost"));
 	}
 
 	@Test
aea651fa5110

LPS-144563 Do not allow unmappable characters

https://github.com/liferay/liferay-portalIstvan SajtosMar 18, 2022via ghsa
commit
1 file changed · +6 −0
  • portal-impl/src/com/liferay/portal/util/PortalImpl.java+6 −0 modified
    @@ -907,6 +907,10 @@ public String escapeRedirect(String url) {
 			return url;
 		}
 
+		if (url.contains(_UNICODE_REPLACEMENT_CHARACTER)) {
+			return null;
+		}
+
 		URI uri = HttpUtil.getURI(url);
 
 		if (uri == null) {
@@ -8764,6 +8768,8 @@ else if (groupFriendlyURL.contains(layoutFriendlyURL)) {
 	private static final String _PUBLIC_GROUP_SERVLET_MAPPING =
 		PropsValues.LAYOUT_FRIENDLY_URL_PUBLIC_SERVLET_MAPPING;
 
+	private static final String _UNICODE_REPLACEMENT_CHARACTER = "\uFFFD";
+
 	private static final Log _log = LogFactoryUtil.getLog(PortalImpl.class);
 
 	private static final Pattern _bannedResourceIdPattern = Pattern.compile(

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.