AI analysis
Apache Nutch 1.10 through 1.22 ship a Nutch Server (REST API) component that fails to enforce authorization (CWE-862) and handles resource shutdown and job lifecycle incorrectly (CWE-404). An unauthenticated attacker who can reach the Nutch REST API can issue requests that force the Nutch server to shut down and interrupt any crawl jobs in progress. The impact is denial of service and loss of in-flight crawl work; there is no indication of remote code execution or data compromise. Anyone running the affected Nutch versions with the Nutch Server/REST API enabled and reachable by untrusted users is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and there are no confirmed reports of in-the-wild exploitation.
What to do: Upgrade to Apache Nutch 1.23, which removes the vulnerable Nutch Server component. If upgrading is not possible, restrict access to instances running the Nutch Service to trusted users only, e.g. by firewalling or placing authentication in front of the REST API. Check whether the Nutch Server/REST API is enabled in your deployment and whether it is reachable from untrusted networks or users.
Affected
| Apache Software Foundation Apache Nutch (Nutch Server / Nutch REST API) | 1.10 through 1.22 (fixed in 1.23, which removes the Nutch Server) |
Estimated exposure
nichelikely only thousands of deployments worldwide, with only a subset exposing the Nutch REST API to untrusted users — Apache Nutch is a niche open-source Java web crawler with no published active-install counts or public internet-exposure scan data, so the estimate assumes limited adoption concentrated in search/indexing and research deployments.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .