Allows attackers to hijack your session even if your password is changed.
Overview
A critical session management vulnerability (CVE-2025-24859) has been discovered in Apache Roller (versions up to and including 6.1.4), where active user sessions are not properly invalidated after password changes. This flaw allows attackers to maintain access to an account even after the password has been changed, potentially leading to unauthorized account access and privilege escalation.
The vulnerability has been assigned a CVSS-B score of 10.0 (CRITICAL) due to its potential impact on authentication security. The issue has been fixed in Apache Roller 6.1.5, which implements centralized session management to invalidate all active sessions upon password changes or account deactivation.
Technical Details
Root Cause
Apache Roller, a popular Java-based blogging platform, previously lacked a mechanism to terminate existing sessions when a user's password was modified. This means:
If a user changed their password, old sessions remained active.
If an administrator reset a user’s password, the user could still access their account via an existing session.
Attackers who had stolen session tokens could continue using them even after the victim changed their password.
Affected Versions
Apache Roller ≤ 6.1.4
Fixed Version
Apache Roller 6.1.5 (implements session invalidation on password change)
Exploitation Scenario
Scenario 1: Attacker Maintains Access After Password Reset
Initial Compromise: An attacker steals a user’s session cookie (e.g., via XSS, MITM, or malware).
Victim Changes Password: The victim detects suspicious activity and changes their password.
Attacker Retains Access: Since old sessions are not invalidated, the attacker continues using the stolen session to access the victim’s account.
Privilege Abuse: The attacker may post malicious content, steal sensitive data, or escalate privileges.
Scenario 2: Administrator Password Reset Bypass
Admin Resets User Password: An administrator resets a compromised user’s password.
User Still Logged In: The user (or attacker) remains logged in via an existing session, bypassing the security measure.
Continued Malicious Activity: The attacker maintains persistence in the system despite the password reset.
Mitigation & Fixes
Immediate Actions
Upgrade to Apache Roller 6.1.5 (or later) to ensure session invalidation on password changes.
Force Logout All Sessions: Administrators should manually invalidate sessions after critical changes.
Monitor for Suspicious Activity: Check logs for unusual login patterns.
Workarounds (If Upgrade Not Possible)
Implement a custom session management layer that tracks password changes and invalidates sessions.
Use reverse proxy rules to enforce session timeouts.
Conclusion
CVE-2025-24859 is a severe security flaw that undermines the effectiveness of password resets in Apache Roller. Organizations using affected versions should prioritize upgrading to 6.1.5 to prevent unauthorized access. Proper session management is critical to ensuring that password changes effectively terminate all active sessions.
Published Date: April 14, 2025
CVSS-B Score: 10.0 (CRITICAL)
Affected Software: Apache Roller ≤ 6.1.4
Patched Version: Apache Roller 6.1.5
Reference- https://nvd.nist.gov/