Apache Tika — unauthenticated SSRF / XXE

A crafted document parsed by Tika made the server fetch attacker-chosen URLs and read local files.

What happened

Apache Tika extracts text from documents server-side. A 2025 flaw let an unauthenticated attacker submit a document whose XML declared an external entity, so the parser reached out to internal URLs (SSRF — e.g. the cloud metadata endpoint) or read local files (XXE). Because Tika runs inside ingestion pipelines, one uploaded file could pivot into the internal network.

The code

// XML parser with external entities left ON
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
DocumentBuilder b = f.newDocumentBuilder();
b.parse(userUpload);   // <!ENTITY x SYSTEM "http://169.254.169.254/..."> resolves

DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setFeature("http://xml.org/sax/features/external-general-entities", false);
f.setXIncludeAware(false); f.setExpandEntityReferences(false);
// + allowlist egress so SSRF can't reach 169.254.169.254 / internal IPs

References

• OWASP XXE Prevention
• CWE-611

Educational case study. The "vulnerable" snippet is a minimal teaching example, not a working exploit. Benteng · a Palu Gada tool.