CyberSecurity news

FlagThis - #apache

@securityonline.info //
A critical vulnerability, CVE-2025-46762, has been identified in Apache Parquet Java, a widely used open-source columnar storage format. This flaw exposes systems to potential remote code execution (RCE) attacks through insecure schema parsing in the parquet-avro module. The vulnerability resides in how Avro schemas are deserialized from metadata stored in Parquet files, potentially allowing malicious actors to inject code into the file's metadata. If an application uses parquet-avro to read Parquet files and employs the specific or reflective Avro deserialization models, processing an untrusted Parquet file could trigger unauthorized code execution during schema parsing.

The vulnerability impacts all versions of Apache Parquet Java up to and including 1.15.1, where schema parsing in the parquet-avro module allows bad actors to execute arbitrary code. While version 1.15.1 introduced restrictions on untrusted packages, the default list of trusted packages remained permissive, possibly enabling attackers to exploit the vulnerability using classes from whitelisted packages. Exploitability is contingent upon specific usage patterns, primarily when applications use parquet-avro, employ the specific or reflective Avro deserialization models, and process untrusted or user-supplied Parquet files.

To mitigate this serious threat, Apache recommends upgrading to version 1.15.2, which includes hardened default settings to prevent execution from trusted but potentially dangerous packages. Users on version 1.15.1 can explicitly set the system property org.apache. Although this vulnerability is not exploitable by default, the potential for RCE makes it a high-priority concern for organizations utilizing Apache Parquet in data-intensive applications and analytics pipelines, especially those dealing with untrusted data sources.

Recommended read:
References :
  • securityonline.info: CVE-2025-46762: Apache Parquet Java Flaw Allows Potential RCE via Avro Schema
  • securityonline.info: CVE-2025-46762: Apache Parquet Java Flaw Allows Potential RCE via Avro Schema
  • thecyberexpress.com: Apache Parquet Java Vulnerability CVE-2025-46762 Exposes Systems to Remote Code Execution Attacks
  • F5 Labs All: Canary Exploit tool for CVE-2025-30065 Apache Parquet Avro Vulnerability
  • BleepingComputer: Apache Parquet exploit tool detect servers vulnerable to critical flaw
  • The DefendOps Diaries: TheDefendOpsDiaries about Apache Parquet
  • securityaffairs.com: Canary Exploit tool allows to find servers affected by Apache Parquet flaw
  • Security Risk Advisors: CVE-2025-30065 – Critical Vulnerability in Apache Parquet Enables Arbitrary Class Instantiation via Malicious Avro Files

CISA@All CISA Advisories //
CISA has added two new vulnerabilities, CVE-2024-38475 and CVE-2023-44221, to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities affect Apache HTTP Server and SonicWall SMA100 series appliances, posing significant risks to organizations that utilize these technologies. The agency is urging organizations to take immediate action to mitigate potential exploits. The addition to the KEV catalog highlights the active exploitation of these flaws in the wild, increasing the urgency for patching and remediation.

The vulnerabilities impacting SonicWall SMA 100 devices are particularly concerning due to the potential for complete system takeover and session hijacking. Cybersecurity researchers at watchTowr have discovered that malicious actors are actively combining these vulnerabilities. CVE-2024-38475, an Apache HTTP pre-authentication arbitrary file read vulnerability discovered by Orange Tsai, allows unauthorized file reading. CVE-2023-44221, a post-authentication command injection flaw discovered by Wenjie Zhong (H4lo) of DBappSecurity Co., Ltd, enables attackers to execute arbitrary commands on affected systems.

The combination of these two vulnerabilities allows attackers to extract sensitive information, such as administrator session tokens, effectively bypassing login credentials. Once this initial foothold is established, the command injection vulnerability can be exploited to execute arbitrary commands, potentially leading to session hijacking and full system compromise. The vulnerabilities affect SMA 100 series appliances, including models SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v. watchTowr has warned of active exploitation of these vulnerabilities, urging organizations to apply available patches to secure their systems.

Recommended read:
References :
  • watchTowr Labs: SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475)
  • thecyberexpress.com: CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221
  • thecyberexpress.com: CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221
  • securityaffairs.com: U.S. CISA adds SonicWall SMA100 and Apache HTTP Server flaws to its Known Exploited Vulnerabilities catalog

@securityonline.info //
A critical security vulnerability has been discovered in Apache Roller, a Java-based blogging server software. The flaw, identified as CVE-2025-24859 and carrying a maximum severity CVSS score of 10.0, allows attackers to retain unauthorized access even after a user changes their password. This session management issue affects Apache Roller versions up to and including 6.1.4, potentially exposing blogs to unauthorized actions and undermining the security measures intended by password changes.

The vulnerability stems from the failure to properly invalidate active user sessions when a password is changed, either by the user or an administrator. This means that an attacker who has compromised a user's credentials could maintain continued access through an old session, even after the user has taken steps to secure their account by changing their password. This poses a significant risk, as it could enable unauthorized individuals to access and manipulate blog content, potentially leading to data breaches or other malicious activities.

To address this critical flaw, Apache Roller version 6.1.5 has been released with a fix that implements centralized session management. This ensures that all active sessions are invalidated when passwords are changed or users are disabled, effectively preventing attackers from maintaining unauthorized access. Users of Apache Roller are strongly advised to upgrade to version 6.1.5 as soon as possible to mitigate the risk of exploitation and safeguard their blog sites from potential security breaches. The vulnerability was discovered and reported by security researcher Haining Meng.

Recommended read:
References :
  • securityaffairs.com: Critical Apache Roller flaw allows to retain unauthorized access even after a password change
  • securityonline.info: CVE-2025-24859 (CVSSv4 10): Apache Roller Flaw Exposes Blogs to Unauthorized Access
  • The Hacker News: Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence
  • bsky.app: 10/10 CVSS in the Apache Roller blogging platform "active user sessions are not properly invalidated after password changes"
  • ciso2ciso.com: Critical Apache Roller flaw allows to retain unauthorized access even after a password change – Source: securityaffairs.com
  • lists.apache.org: Apache Roller Fails to Invalidate Sessions on Password Change (CVE-2025-24859)

Pierluigi Paganini@securityaffairs.com //
CISA has added a new Apache Tomcat vulnerability, identified as CVE-2025-24813, to its Known Exploited Vulnerabilities (KEV) catalog. This action follows evidence that the flaw is being actively exploited in the wild, posing a significant risk to organizations utilizing affected versions of Apache Tomcat. The vulnerability is a path equivalence issue within Apache Tomcat.

To mitigate the risk posed by CVE-2025-24813, impacted users are urged to upgrade their Apache Tomcat installations to the latest secure versions. Specifically, upgrades to Apache Tomcat 11.0.3 or later, Apache Tomcat 10.1.35 or later, or Apache Tomcat 9.0.99 or later are recommended. The advisory also includes IPS protection measures to detect and block potential attack attempts targeting this vulnerability affecting the Apache Tomcat web server.

Recommended read:
References :

Divya@gbhackers.com //
A critical vulnerability, CVE-2025-27017, has been identified in Apache NiFi, a popular data flow automation tool used by thousands of companies. The flaw affects versions 1.13.0 through 2.2.0 and exposes MongoDB credentials. An authorized user with read access to the system provenance records may see the credentials used to connect to MongoDB databases, potentially extracting the MongoDB credentials and gaining unauthorized access to sensitive data.

The vulnerability stems from the inclusion of MongoDB usernames and passwords in NiFi provenance events. This poses a significant risk, potentially leading to data breaches or tampering. NiFi is widely used to automate data pipelines for cybersecurity, observability, event streams, and generative AI applications, making this a high-priority concern for organizations leveraging the affected versions.

The vulnerability has been addressed in Apache NiFi 2.3.0, which removes the credentials from provenance event records. Users of affected versions are strongly urged to upgrade to the latest release to mitigate the risk of credential exposure. Organizations using Apache NiFi should prioritize updating their systems to the latest version to protect their MongoDB credentials and prevent potential data breaches.

Recommended read:
References :

do son@Daily CyberSecurity //
A critical security vulnerability, CVE-2025-24813, has been identified in Apache Tomcat, potentially exposing servers to remote code execution (RCE) and data leaks. The vulnerability stems from a path equivalence issue related to how Tomcat handles filenames with internal dots, particularly when writes are enabled for the default servlet and partial PUT support is enabled. This flaw could allow attackers to execute malicious code, disclose sensitive information, or inject malicious content into uploaded files.

Users of Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98 are advised to upgrade immediately to versions 11.0.3, 10.1.35, or 9.0.99 respectively, which include the necessary fixes. The vulnerability exists if an application uses Tomcat's file-based session persistence with the default storage location and includes a library susceptible to deserialization attacks, potentially leading to remote code execution. COSCo Shipping Lines DIC and sw0rd1ight are credited with discovering and reporting the vulnerability.

Recommended read:
References :
  • gbhackers.com: Apache Tomcat Flaw Could Allow RCE Attacks on Servers
  • cR0w :cascadia:: Tomcat vulns are always fun, right? H/T: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
  • buherator's timeline: [oss-security] CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or ...
  • Open Source Security: CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
  • securityonline.info: CVE-2025-24813 Flaw in Apache Tomcat Exposes Servers to RCE, Data Leaks: Update Immediately
  • buherator's timeline: Analysis of CVE-2025-24813 Apache Tomcat Path Equivalence RCE
  • BleepingComputer: A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request. [...]
  • securityonline.info: Tomcat Flaw CVE-2025-24813 Exploited in the Wild, PoC Released
  • securityaffairs.com: Threat actors rapidly exploit new Apache Tomcat flaw following PoC release
  • infosecwriteups.com: CVE-2025–24813: Apache Tomcat Path Equivalence Vulnerability $$$$ BOUNTY
  • The Hacker News: The Hacker News reports on Apache Tomcat Vulnerability Actively Exploited Just 30 Hours After Public Disclosure
  • www.scworld.com: Apache Tomcat flaw actively exploited; could allow 'devastating' RCE
  • bsky.app: Bsky Social - A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request.
  • bsky.app: A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request.
  • The Register - Software: One PUT request, one poisoned session file, and the server’s yours A trivial flaw in Apache Tomcat that allows remote code execution and access to sensitive files is said to be under attack in the wild within a week of its disclosure.