PT-2013-4901 · Apache · Apache Roller

Juan Vazquez · Publicado 2013-12-07 · Atualizado 2017-08-29 · CVE-2013-4212

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2

Description The issue allows remote attackers to execute arbitrary OGNL expressions via certain parameters, such as the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol. This is possible due to certain getText methods in the ActionSupport controller.

Recommendations For Apache Roller versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the roller-ui/login.rol URL and its subclasses, such as UIAction, to minimize the risk of exploitation. Avoid using the pageTitle parameter in the !getPageTitle sub-URL until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-4212

Produtos afetados

Apache Roller

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_roller_ognl_injection.rb · Exploit
• 🔥 https://exploit-db.com/exploits/29859 · Exploit
• 🔥 http://exploit-db.com/exploits/29859 · Exploit
• http://osvdb.org/100342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4212 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89239 · Nota
• http://security.coverity.com/advisory/2013/Oct/remote-code-execution-in-apache-roller-via-ognl-injection.html · Nota
• http://secunia.com/advisories/55862 · Aviso do Fabricante
• http://rollerweblogger.org/project/entry/apache_roller_5_0_2 · Correção
• http://secunia.com/advisories/55877 · Aviso do Fabricante