CVE-2018-11762

Vulnerability

In Apache Tika versions 0.9 through 1.18, a rare edge case exists where the user does not specify an extract directory via the --extract-dir= command-line option, and the input file contains an embedded file with an absolute path (e.g., C:/evil.bat). In this scenario, tika-app would overwrite the file at that absolute path [1][2].

Exploitation

An attacker must craft an input file (e.g., a document) containing an embedded file whose filename is an absolute path (such as C:/evil.bat). The victim must run tika-app without using the --extract-dir flag and extract embedded files. No special authentication or network position is required; the attack relies on the victim processing the malicious file [1][2].

Impact

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's filesystem at the path specified in the embedded file. This can lead to privilege escalation, denial of service, or code execution if the overwritten file is an executable or critical system file [1][2].

Mitigation

The vulnerability is fixed in Apache Tika 1.19 [2]. Users should upgrade to version 1.19 or later. As a workaround, always explicitly specify a safe extract directory using the --extract-dir= option when running tika-app [1][2].