PT-2013-4901 · Apache · Apache Roller

Juan Vazquez · Published 2013-12-07 · Updated 2017-08-29 · CVE-2013-4212

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2

Description The issue allows remote attackers to execute arbitrary OGNL expressions via certain parameters, such as the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol. This is possible due to certain getText methods in the ActionSupport controller.

Recommendations For Apache Roller versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the roller-ui/login.rol URL and its subclasses, such as UIAction, to minimize the risk of exploitation. Avoid using the pageTitle parameter in the !getPageTitle sub-URL until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-4212

Affected Products

Apache Roller

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_roller_ognl_injection.rb · Exploit
• 🔥 https://exploit-db.com/exploits/29859 · Exploit
• 🔥 http://exploit-db.com/exploits/29859 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4212 · Security Note
• http://secunia.com/advisories/55862 · Vendor Advisory
• http://rollerweblogger.org/project/entry/apache_roller_5_0_2 · Patch
• http://secunia.com/advisories/55877 · Vendor Advisory
• http://osvdb.org/100342 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89239 · Note
• http://security.coverity.com/advisory/2013/Oct/remote-code-execution-in-apache-roller-via-ognl-injection.html · Note