Apache Tika - XXE Injection

id: CVE-2025-54988

info:
  name: Apache Tika - XXE Injection
  author: tx1ee
  severity: critical
  description: |
    Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks.
  impact: |
    An attacker can read sensitive server files or perform SSRF attacks against internal infrastructure.
  remediation: |
    Upgrade to Apache Tika 3.2.2 or later.
  reference:
    - https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
    - https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54988
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.045
    cwe-id: CWE-611
  metadata:
    verified: true
    max-request: 4
    vendor: apache
    product: tika
    shodan-query: title:"Apache Tika"
    fofa-query: title="Apache Tika"
  tags: cve,cve2025,apache,tika,xxe,ssrf,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/tika"

    stop-at-first-match: true
    redirects: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Apache Tika'
          - 'This is Tika'
        condition: or
        internal: true

    extractors:
      - type: regex
        part: body
        regex:
          - "Apache Tika [0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
          - "Apache Tika v?([0-9]+\\.[0-9]+\\.[0-9]+)"

  - method: PUT
    path:
      - "{{BaseURL}}/tika"

    headers:
      Accept: text/plain
      Content-Type: application/pdf
      X-Tika-PDFextractInlineImages: "true"
      X-Tika-PDFextractMarkedContent: "true"

    body: |
      %PDF-1.4
      1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj
      2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj
      3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]
      /Contents 4 0 R/Resources<<>>>>endobj
      4 0 obj<</Length 44>>
      stream
      BT /F1 12 Tf 100 700 Td ({{randstr}}) Tj ET
      endstream
      endobj
      xref
      0 5
      0000000000 65535 f
      0000000009 00000 n
      0000000058 00000 n
      0000000115 00000 n
      0000000214 00000 n
      trailer<</Size 5/Root 1 0 R>>
      startxref
      307
      %%EOF

    matchers:
      - type: dsl
        dsl:
          - status_code == 200 || status_code == 201
          - contains(body, "{{randstr}}")
          - contains(header,"text/plain")
        condition: and
# digest: 490a0046304402207d3b19316b23c8953f1b2d1782a86e7f5b515db09e1873d8bbc3824377e5538302201e6eda0790388a2fa8bd074d012f4487599e11563a2a56a98ae5daa9aa19632c:922c64590222798bb761d5b6d8e72950