CVE-2018-1335

Vulnerability

From Apache Tika versions 1.7 to 1.17, the tika-server component can be exploited by sending carefully crafted HTTP headers. The server uses these headers in command-line invocations without proper sanitization, allowing an attacker to inject arbitrary operating system commands. This vulnerability only affects deployments where tika-server is exposed to untrusted clients. The affected versions are 1.7 through 1.17 [2][4].

Exploitation

An attacker must be able to send HTTP requests to the tika-server instance. No authentication is required if the server is exposed to untrusted networks. The attacker crafts specific headers that, when processed by the server, are injected into command-line arguments passed to underlying operating system utilities. The exact sequence involves sending a malicious request with crafted header values that break out of the intended argument and append arbitrary commands [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the server with the privileges of the Tika process. This leads to full remote code execution (RCE), enabling compromise of the host system's confidentiality, integrity, and availability [2][3].

Mitigation

Upgrading to Apache Tika 1.18 or later resolves the vulnerability [2][4]. Red Hat released an advisory (RHSA-2019:3140) for Red Hat JBoss Data Virtualization 6.4.8, which includes the fix [3]. No workarounds are documented for deployments that cannot immediately upgrade; the only secure option is to restrict network access to tika-server until the patch is applied.