.. / CVE-2018-1335

• RCE
• Nuclei
• Web

Exploit for Apache Tika <1.1.8- Header Command Injection (CVE-2018-1335)

Description:

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.

Nuclei Template

View the template here CVE-2018-1335.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-1335.yaml

References: