Information Disclosure in Apache Roller via Velocity Template

Executive Summary

This vulnerability in Apache Roller 6.1.5 allows a weblog administrator to access sensitive files on the application classpath, including configuration files with secrets, by creating a Velocity template that uses an include directive to load external resources. The issue occurs because the include and parse directives bypass the Velocity sandbox, which is meant to restrict untrusted administrators.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Apache Roller versions for 6.1.5 or earlier. Inspect weblog templates for Velocity directives like #include or #parse that reference absolute paths or classpath resources outside the theme namespace. Review logs for unauthorized file access attempts by weblog administrators.

Useful 0 Not Useful 0

Impact Analysis

If you are a weblog administrator using Apache Roller 6.1.5, an attacker with administrator access could exploit this to read sensitive files like configuration files containing secrets. This could lead to unauthorized access to system data or credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA by exposing personal or protected health information. Unauthorized access to configuration files could also result in data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache Roller to version 6.1.6 or later immediately. Restrict weblog administrator privileges to trusted users only. Review and remove any existing templates using #include or #parse directives that access non-theme resources.

Useful 0 Not Useful 0