AI analysis
The Nutch Server component of Apache Nutch (its REST API) fails to require authorization for requests (CWE-862) and allows externally controlled input to select classes and dynamically managed code resources (CWE-470, CWE-913), culminating in JEXL (Java Expression Language) injection that is evaluated server-side (CWE-94). An unauthenticated attacker who can reach the Nutch REST API can send crafted requests whose injected expressions are executed by the server, gaining remote code execution in the context of the Nutch process. All Apache Nutch releases from 1.11 through 1.22 are affected when the Nutch Server is running; version 1.23 resolves the issue by removing the Nutch Server entirely. No CVSS score has been assigned yet, the flaw is not in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.
What to do: Upgrade to Apache Nutch 1.23, which removes the Nutch Server; if an upgrade is not possible, restrict access to instances running the Nutch Service to trusted users only using authentication and network/firewall rules. Check whether your deployment runs the Nutch Server/REST API and whether it is reachable from untrusted networks, and monitor the Apache Nutch security advisories page (https://nutch.apache.org/documentation/security/) as a CVSS score and PoC may emerge.
Affected
| Apache Nutch (Nutch Server / Nutch REST API) | 1.11 through 1.22 (inclusive); fixed in 1.23, which removes the Nutch Server |
Estimated exposure
nichelikely low thousands of deployments at most (exact installed base unknown) — No public install-count or internet-exposure scan data exists for Nutch; it is a niche Apache open-source crawler typically self-hosted by research and search-infrastructure teams, and only deployments actually running the Nutch Server…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .