CVE-2013-4212

Apache Roller < 5.0.2 - Remote Code Execution via OGNL Injection in getText Methods

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2013-4212. PoCs published by Metasploit, Unknown, juan vazquez, including Metasploit module exploits/multi/http/apache_roller_ognl_injection.

AI-analyzed exploit summary This Metasploit module exploits an OGNL injection vulnerability in Apache Roller < 5.0.2 via the UIAction controller, allowing remote code execution by injecting malicious OGNL expressions through the 'pageTitle' parameter.

Description

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotejava
https://www.exploit-db.com/exploits/29859

This Metasploit module exploits an OGNL injection vulnerability in Apache Roller < 5.0.2 via the UIAction controller, allowing remote code execution by injecting malicious OGNL expressions through the 'pageTitle' parameter.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Roller < 5.0.2
No auth needed
Prerequisites: Network access to the target Apache Roller instance · Apache Roller version < 5.0.2
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Unknown, juan vazquez · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_roller_ognl_injection.rb

This Metasploit module exploits an OGNL injection vulnerability in Apache Roller < 5.0.2 via insecure usage of the ActionSupport.getText method, allowing remote code execution by uploading and executing a malicious JAR payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Roller < 5.0.2
No auth needed
Prerequisites: Network access to the target Apache Roller instance · Target running a vulnerable version of Apache Roller
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/100342
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/29859
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/89239
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55862
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55877

Scores

EPSS 0.8107
EPSS Percentile 99.6%

Details

CWE
CWE-94
Status published
Products (4)
apache/roller 4.0
apache/roller 4.0.1
apache/roller 5.0
apache/roller < 5.0.1
Published Dec 07, 2013
Tracked Since Feb 18, 2026