CVE-2025-43772 in Liferay
Summary
by MITRE • 09/04/2025
Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2025
The vulnerability identified as CVE-2025-43772 affects Kaleo Forms Admin functionality within Liferay Portal and Liferay DXP platforms across multiple version ranges including 7.0.0 through 7.4.3.4 for Portal and various DXP releases. This issue represents a critical security flaw that enables remote attackers to exploit memory consumption patterns through carefully crafted HTTP requests. The vulnerability stems from inadequate parameter validation and session management within the portlet framework, specifically in how request parameters are stored and handled during form processing operations.
The technical root cause of this vulnerability lies in the improper handling of request parameters within the portlet session storage mechanism. When users interact with Kaleo Forms Admin portlets, the system stores incoming request parameters directly into the session without sufficient validation or size limitations. This design flaw allows attackers to submit malicious requests containing excessive or repeated parameter data that gets persisted in the session storage. The vulnerability is categorized under CWE-400 as an "Uncontrolled Resource Consumption" or "Resource Exhaustion" condition, where the system's memory resources become depleted due to unbounded parameter storage.
From an operational perspective, this vulnerability creates significant denial-of-service conditions that can severely impact system availability and performance. Attackers can systematically consume available memory resources by submitting requests with large parameter sets or by repeatedly submitting the same parameters, causing the application server to gradually exhaust its memory allocation. This leads to application slowdowns, crashes, or complete unavailability of the affected portlets and potentially the entire portal instance. The impact extends beyond simple service disruption as it can affect other applications running on the same server infrastructure, creating cascading failures that compromise overall system stability.
The attack vector for this vulnerability is entirely remote and requires no authentication credentials, making it particularly dangerous in production environments. The exploitation process involves sending crafted HTTP requests that contain oversized parameter values or parameter repetition patterns designed to maximize memory consumption within the session storage. This aligns with ATT&CK technique T1499.004 for "Endpoint Denial of Service" and demonstrates how seemingly benign functionality can be weaponized for system compromise. The vulnerability affects not only the immediate form processing capabilities but also impacts the broader portal ecosystem's resource management and stability.
Organizations should implement immediate mitigations including parameter size validation, session storage limits, and rate limiting mechanisms to prevent excessive memory consumption. The recommended approach involves configuring maximum parameter limits within the Liferay portal configuration files and implementing custom session management policies that prevent unlimited parameter storage. Additionally, network-level controls such as intrusion detection systems and web application firewalls can help identify and block suspicious parameter patterns. The vulnerability highlights the importance of proper input validation and resource management in enterprise portal platforms, emphasizing that even administrative components must follow security-by-design principles to prevent resource exhaustion attacks that can compromise system availability and user experience.