cve-2018-1335

安卡拉耶尔德勒姆贝亚齐特大学计算机工程系 CENG 325 - 信息安全与隐私原理 CENG201 面向对象编程项目 小组成员 @canumay @aslihann @ezgigucuyener @mburakdonmez 参考文献 NVD - CVE-2018-1335 漏洞利用数据库 - Apache Tika-server 1.18 - 命令注入 Rhino安全实验室 - 利用CVE-2018-1335：Apache Tika中的命令注入 Metasploit 免责声明 该利用代码由网络安全研究员David Yesland @Daveysec 编写，仅供教育用途使用。 里程碑1 –...

CVE-2018-1335

CVE-2018-1335 对版本低于1.18的Apache Tika-server服务器的RCE（远程代码执行）漏洞 命令： sudo bash install.sh python2 exploit.py...

Improper Protection of Alternate Path

Overview Affected versions of this package are vulnerable to Improper Protection of Alternate Path through the TikaServerConfig endpoint gating in the server configuration and request-handling code. An attacker can reach disabled server-side config and pipe-related paths by sending requests to th...

Linux Distros Unpatched Vulnerability : CVE-2018-1335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line o...

VulnCheck KEV: CVE-2018-1335

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients...

Apache Tika < 1.28.2, 2.x < 2.4.0 Multiple Vulnerabilities

Apache Tika is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; ifdescription...

Apache Tika 2.x < 2.2.0 Log4j RCE Vulnerability (Log4Shell)

Apache Tika is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Tika 1.x <= 1.23 Multiple Vulnerabilities

Apache Tika is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; ifdescription...

tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients...

Apache Tika 1.19 < 1.22 DoS Vulnerability

Apache Tika is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; if...

Apache Tika-server 1.18 - Command Injection

Apache Tika-server 1.18 - Command Injection Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url =...

Apache Tika Server Command Injection

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

Apache Tika-server < 1.18 - Command Injection

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

Apache Tika-server < 1.18 - Command Injection Exploit

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

Apache Tika < 1.20 DoS Vulnerability

Apache Tika is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; if...

Apache Tika Server exposes sensitive information

Apache Tika provides optional functionality to run itself as a web service to allow remote use. When used in this manner, it's possible for a 3rd party to pass a 'fileUrl' header to the Apache Tika Server tika-server before version 1.10. This header lets a remote client request that the server...

GHSA-9R24-GP44-H3PM Command injection in org.apache.tika:tika-core

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients...

Command injection in org.apache.tika:tika-core

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients...

Apache Tika 1.2 - 1.18 DoS Vulnerability

Apache Tika is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika";...

Apache Tika < 1.19.1 Multiple Vulnerabilities

Apache Tika is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; ifdescription...