PT-2016-3610 · Apache · Apache Tika Server

Tim Allison · Published 2016-12-15 · Updated 2023-02-13 · CVE-2015-3271

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tika server (aka tika-server) version 1.9

Description The issue allows remote attackers to read arbitrary files via the HTTP fileUrl header. This is possible when Apache Tika is used as a web service, enabling a 3rd party to pass a fileUrl header to the Apache Tika Server. The header lets a remote client request that the server fetches content from the URL provided, including files from the server's local filesystem. Depending on the file permissions set on the local filesystem, this could be used to return sensitive content from the server machine.

Recommendations For Apache Tika server version 1.9, consider updating to version 1.10 or later to resolve the issue. As a temporary workaround, restrict access to the tika-server URL to prevent un-trusted access. Additionally, consider disabling the fileUrl header functionality until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-3271

GHSA-CCJP-W723-2JF2

Affected Products

Apache Tika Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-3271 · Security Note
• https://osv.dev/vulnerability/GHSA-ccjp-w723-2jf2 · Vendor Advisory
• https://github.com/apache/tika · Note
• https://github.com/advisories/GHSA-ccjp-w723-2jf2 · Note
• http://openwall.com/lists/oss-security/2015/08/13/5 · Note
• https://lists.apache.org/thread.html/d2b3e7afb0251fac95fdee9817423cbc91e3d99a848c25a51d91c1e8%401439485507%40%3Cdev.tika.apache.org%3E · Note
• http://securityfocus.com/bid/95020 · Note
• https://lists.apache.org/thread.html/d2b3e7afb0251fac95fdee9817423cbc91e3d99a848c25a51d91c1e8@1439485507@%3Cdev.tika.apache.org%3E · Note