Apache Tika Vulnerability: File Overwrite Risk Due to Absolute Path Extraction
Summary
CVE-2018-11762: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat",... Affects tika across 2 version ranges.
< 1.20-1
>= eb1cd6a1665a9034195b30172c0199a6143bcd45, <= 38ff2a986af24ee255f1f91d654ea402f4016696
Fixed in 1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is a content analysis toolkit that enables users to extract text and metadata from various file formats. It is widely used for document processing and data extraction tasks. The toolkit supports a range of file types and is designed to facilitate the integration of content extraction into applications. However, versions 0.9 to 1.18 of Tika have a vulnerability that can lead to unintended file overwrites when certain conditions are met.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11762, arises when a user does not specify an extract directory on the command line using the '--extract-dir=' option. If the input file contains an embedded file with an absolute path, such as 'C:/evil.bat', the tika-app can overwrite that file. This poses a significant risk, as it could lead to the loss of important files or the execution of malicious scripts, depending on the nature of the overwritten file. The vulnerability affects users who rely on default settings without specifying an extract directory.
How To Fix
Minimum fixed version
1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tikaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can specify an extract directory when running the tika-app command. For example: tika-app --extract-dir=/path/to/extract/dir inputfile.pdf. This ensures that any extracted files are stored in a designated location, preventing accidental overwrites of existing files.
Conclusion
The CVE-2018-11762 vulnerability in Apache Tika poses a significant risk of file overwriting when users do not specify an extract directory. It is crucial for users to upgrade to version 1.20-1 or later and to always specify an extract directory to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tika →
FAQ
Versions 0.9 to 1.18 of Apache Tika are affected by this vulnerability.
The CVSS score of this vulnerability is 5.9.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade immediately, ensure that you specify an extract directory when using the tika-app to mitigate the risk of file overwrites.
The potential consequences include the unintentional overwriting of important files, which could lead to data loss or the execution of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for tika.
