Attack Chain

1. Attacker performs reconnaissance to identify servers running vulnerable Apache Tika versions (< 1.18).
2. Attacker crafts a malicious HTTP PUT request directed at the /meta endpoint.
3. Attacker injects arbitrary commands into the 'X-Tika-OCRTesseractPath' header, using double quotes to terminate the intended path string.
4. Attacker modifies the 'X-Tika-OCRLanguage' header to inject execution parameters (e.g., '//E:Jscript') to influence the target's internal processing of temporary files.
5. The server application, expecting a valid image file, saves the request body content as a temporary file on the local filesystem.
6. The Tika-server process invokes the underlying system command (e.g., cscript.exe), executing the malicious temporary file as a script.
7. The injected payload executes, granting the attacker remote command execution privileges with the Tika service account's permissions.

Impact

Successful exploitation results in full remote code execution on the host running the Apache Tika server. This allows attackers to pivot within the network, exfiltrate sensitive files, or install further persistent backdoors. The vulnerability is highly exploitable, as evidenced by its inclusion in the Metasploit framework and a high EPSS score, posing a significant risk to organizations running legacy Tika-server instances.

Recommendation

Prioritize the immediate upgrade of all Apache Tika-server instances to version 1.18 or later. For environments where patching is not immediately feasible, deploy WAF rules to inspect HTTP PUT requests to the /meta endpoint for suspicious patterns in headers like 'X-Tika-OCRTesseractPath' and 'X-Tika-OCRLanguage'.

Rules

title: "Detect CVE-2018-1335 Exploitation - Suspicious OCR Header Injection" description: "Detects exploitation attempts against CVE-2018-1335 by monitoring HTTP PUT requests to the /meta endpoint containing suspicious header content indicating command injection." logsource: category: "webserver" detection: selection: cs-method: "PUT" cs-uri-stem|contains: "/meta" cs-headers|contains:

• "X-Tika-OCRTesseractPath"
• "X-Tika-OCRLanguage" cs-headers|contains:
• "//E:Jscript"
• "cscript.exe"
• "calc.exe" condition: selection level: "high" tags:
• "attack.initial_access"
• "attack.execution"
• "attack.t1203"
• "attack.t1059.003" falsepositives:
• "Legitimate administrative testing using Tika-server headers" tests: positive:
• name: "PUT request with malicious headers" data:
• cs-method: "PUT" cs-uri-stem: "/meta" cs-headers: "X-Tika-OCRTesseractPath: "cscript.exe"" negative:
• name: "Standard Tika request" data:
• cs-method: "PUT" cs-uri-stem: "/meta" cs-headers: "X-Tika-OCRTesseractPath: /usr/bin/tesseract" handoff: detection_confidence: "high" required_telemetry:
• log_source: "webserver" event_or_channel: "HTTP access logs" required_fields:
• "cs-method"
• "cs-uri-stem"
• "cs-headers" availability: "available" notes: "Headers must be logged to capture exploitation attempts" validation: status: "needs_environment_validation" steps:
• "Use curl to send a PUT request to the /meta endpoint with header X-Tika-OCRTesseractPath: "calc.exe"" expected_telemetry: "Webserver logs showing the PUT request with the malicious header" pass_criteria: "Log captured the header values" known_evasions:
• "Using alternative path separators or character encoding to obfuscate header content" limitations:
• "Requires full HTTP header logging to be effective" tuning:
• source: "Internal testing traffic" guidance: "Allowlist known internal vulnerability scanning IP addresses" portability_notes:
• platform: "Splunk|Elastic" note: "Requires field extraction for HTTP headers if not indexed by default" suggested_owner: "Detection Engineering"