Description

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-09T11:17:14.290Z",
  "pubdate": "2026-09-09T11:17:14.290Z",
  "executiveSummary": "The Apache Nutch Server (REST API) is susceptible to Missing Authorization and Improper Resource Shutdown and Job Interruption vulnerabilities.\nThis security flaw allows unauthorized remote actors to interact with the Nutch REST API, potentially leading to unauthorized system operations, arbitrary job termination, or complete service disruption.\nThe vulnerability affects Apache Nutch versions 1.10 through 1.22.\nThe architectural design flaw stems from a lack of inherent authentication controls within the Nutch Server component, enabling any network-adjacent attacker with access to the API port to invoke administrative commands.\nBecause the Nutch REST API lacks robust access control mechanisms, the risk to confidentiality, integrity, and availability is high, particularly in deployments exposed to untrusted networks.\nThe recommended remediation path is to upgrade to version 1.23, which explicitly deprecates and removes the vulnerable Nutch Server component to eliminate the attack surface entirely.\nFor environments unable to upgrade, immediate network-level restrictions are required to ensure that only authenticated and authorized administrative entities can communicate with the service.",
  "technicalDetails": "The identified vulnerability in Apache Nutch (versions 1.10–1.22) resides within the Nutch Server component, which exposes a RESTful API for managing crawl jobs and system configurations.\nThe root cause is a fundamental lack of server-side authentication and authorization checks. By design, the Nutch Server REST interface assumes a trusted environment and fails to validate the identity of clients initiating requests, thereby violating the principle of least privilege.\nAn attacker can exploit this via standard HTTP requests targeting the Nutch Server endpoint. Since the API lacks access control, any actor capable of reaching the service port can issue POST, GET, or DELETE requests to manipulate the crawler lifecycle.\nThe 'Improper Resource Shutdown and Job Interruption' aspect of the vulnerability occurs because the API facilitates commands that allow for the immediate termination of active crawler processes. An unauthorized user can programmatically send requests to stop active jobs, delete configuration files, or clear queue data, effectively performing a Denial of Service (DoS) attack on the harvesting infrastructure.\nThe attack flow typically involves: 1) Reconnaissance to identify the Nutch Server REST API port; 2) Enumeration of active job IDs via unauthenticated GET requests; 3) Execution of malicious or disruptive payloads, such as 'stop' or 'kill' commands, directed at specific process identifiers (PIDs) or job handles; and 4) Continued suppression of resource availability to prevent legitimate administrative intervention.\nThe lack of authentication ensures that the attacker operates with the full privileges of the OS-level user running the Nutch process. Consequently, this vulnerability not only impacts the Nutch service itself but may also lead to collateral system impact, such as resource exhaustion or the unauthorized execution of configuration scripts if the underlying server process runs with elevated privileges.\nThe removal of the Nutch Server in version 1.23 serves as a secure-by-default remediation, acknowledging that the API was inherently flawed from a security architecture perspective and could not be retrofitted with authentication without significant breaking changes."
}