Description

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no non-default configuration is required for this path. This can lead to remote code execution. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which disables the extension types and rejects requests when the XML-RPC feature is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-28T08:16:42.273Z",
  "pubdate": "2026-09-28T08:16:42.273Z",
  "executiveSummary": "Apache Roller 6.1.5 contains a critical vulnerability involving the deserialization of untrusted data via its XML-RPC interface.\nThe vulnerability allows an unauthenticated, remote attacker to execute arbitrary code on the underlying server.\nThis flaw exists because the XML-RPC endpoint improperly processes vendor extension types during the initial parsing phase of a request, occurring before any authentication checks are performed.\nNotably, this endpoint is mapped unconditionally, meaning the vulnerability remains exploitable even if the global XML-RPC feature is disabled within the application configuration.\nThe risk implication is severe, as it grants full remote code execution capabilities to any attacker with network access to the target instance, requiring no valid credentials or specific non-default configurations.\nThe vulnerability has been addressed in version 6.1.6, which implements stricter validation by disabling the insecure extension types and enforcing rejection of requests when the XML-RPC feature is toggled off.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of XML-RPC input streams within Apache Roller 6.1.5. The XML-RPC endpoint is configured as an unconditional servlet mapping, which processes incoming requests prior to the execution of the authentication filter chain.\nDuring the parsing of XML-RPC requests, the application logic incorrectly accepts and processes vendor extension types. These types are deserialized automatically during the parsing phase. Because the parsing engine treats these attacker-controlled bytes as trusted objects, the application is susceptible to deserialization attacks, a common vector for achieving Remote Code Execution (RCE).\nThe exploitation flow proceeds as follows: An attacker sends a specially crafted XML-RPC request to the target server. Because the servlet is mapped unconditionally, the server does not verify if the user is authenticated before invoking the parser. The parser encounters the malicious vendor extension types and attempts to deserialize the payload. If the application environment includes gadget chains in its classpath, the deserialization process triggers the execution of arbitrary code defined by the attacker.\nA critical aspect of this vulnerability is its persistence despite configuration changes. Even when a system administrator attempts to disable the XML-RPC feature, the underlying servlet mapping remains active. Consequently, the parser is still invoked for incoming requests to the XML-RPC endpoint, rendering traditional configuration-based security measures ineffective.\nThis vulnerability is classified as critical due to the lack of required privilege levels or specific deployment conditions. It provides an unauthenticated attacker with the ability to achieve arbitrary code execution in the context of the user running the Apache Roller process. Post-exploitation, an attacker could potentially gain full control over the host, exfiltrate sensitive data, or pivot within the internal network. The fix in Apache Roller 6.1.6 modifies the parsing logic to explicitly reject these insecure extension types and ensures that the XML-RPC feature-gate is respected during the request lifecycle, effectively mitigating the RCE vector."
}