CVE-2018-11762 in Tika
Summary
by MITRE
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/25/2020
Apache Tika version 0.9 through 1.18 contains a critical path traversal vulnerability that arises from improper handling of absolute file paths in embedded documents. This vulnerability specifically manifests when the tika-app command line tool processes files containing embedded content with absolute paths such as "C:/evil.bat" without an explicitly defined extraction directory. The flaw stems from a lack of proper path validation and sanitization mechanisms within the file extraction logic, allowing malicious actors to exploit this condition to overwrite arbitrary files on the target system.
The technical implementation of this vulnerability involves the command line parameter --extract-dir= which serves as a critical safeguard when properly utilized. When users fail to specify this parameter, the application defaults to a working directory context that does not properly validate incoming file paths. The embedded file extraction process does not adequately sanitize absolute paths, enabling a maliciously crafted document to specify paths that bypass normal directory boundaries. This behavior directly violates secure coding practices and represents a classic path traversal vulnerability where user-supplied input is not properly validated before being used in file system operations.
From an operational impact perspective, this vulnerability presents a significant risk to systems processing untrusted documents, particularly in environments where Apache Tika is used for document analysis and content extraction. Attackers can leverage this flaw to overwrite critical system files, executables, or configuration files by crafting embedded documents with absolute paths pointing to sensitive locations on the filesystem. The vulnerability is particularly concerning in automated processing environments where documents are automatically analyzed without explicit user oversight, as it allows for arbitrary file system modification without requiring elevated privileges beyond those needed to execute the vulnerable application. This weakness enables attackers to potentially escalate their control over affected systems by replacing legitimate files with malicious counterparts, creating persistent backdoors or disrupting system functionality.
The vulnerability aligns with CWE-22 Path Traversal and maps to ATT&CK technique T1059 Command and Scripting Interpreter, specifically targeting the execution of malicious payloads through file system manipulation. Organizations should immediately upgrade to Apache Tika version 1.19 or later, which includes proper path validation and sanitization measures. Additional mitigations include implementing strict file input validation, configuring the application to always specify explicit extraction directories, and restricting file processing to trusted sources only. Network segmentation and monitoring for suspicious file system modifications can provide additional layers of defense. The vulnerability also highlights the importance of proper input validation in file processing applications and demonstrates how seemingly minor implementation oversights can create significant security risks in document analysis tools that are widely deployed across enterprise environments.