Description

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-09T11:17:14.570Z",
  "pubdate": "2026-09-09T11:17:14.570Z",
  "executiveSummary": "Apache Nutch is susceptible to a critical security vulnerability involving Missing Authorization and Unsafe Reflection within the Nutch REST API.\nThis flaw enables unauthorized actors to influence the selection of classes or code execution paths via externally-controlled input, bypassing intended security boundaries.\nThe vulnerability affects Apache Nutch versions 1.10 through 1.22.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary code or manipulate server-side logic by injecting malicious class references.\nThe risk implication is severe, as the Nutch Server exposes these sensitive operations without sufficient validation or access control mechanisms.\nDue to the nature of the flaw, attackers do not require pre-existing privileges to interact with the REST API if the endpoint is network-accessible.\nThe primary impact involves complete compromise of the Nutch server instance, potentially leading to unauthorized data access, system disruption, or further lateral movement within the hosting environment.\nImmediate remediation involves upgrading to version 1.23, which fundamentally removes the vulnerable Nutch Server component.",
  "technicalDetails": "The core of the vulnerability resides within the Nutch REST API's handling of user-supplied data, specifically where input is utilized to instantiate objects or select classes through reflection mechanisms.\nThe application fails to implement adequate authorization checks, allowing an attacker to interact with the API endpoints that facilitate reflection-based operations.\nIn an 'Unsafe Reflection' scenario, the server takes externally-controlled input—such as class names or parameters passed via HTTP requests—and uses them directly in reflection APIs (e.g., Class.forName() or similar instantiation methods) without performing strict validation or allowlisting.\nAn attacker can exploit this by crafting a malicious payload that specifies an arbitrary class present in the application's classpath that, when instantiated or invoked, triggers unintended side effects. Because the API lacks access control, an unauthenticated user can submit these payloads directly to the REST service.\nThe attack flow proceeds as follows: First, the attacker performs reconnaissance on the Nutch REST API to identify endpoints that accept class names or configurations as input. Second, the attacker constructs a serialized or parameter-based request containing a target class identifier that is known to exist within the Nutch environment. Third, the application receives this input and passes it to the underlying reflection engine. Fourth, the JVM attempts to load and instantiate the attacker-specified class, thereby executing the code path associated with that class's constructor or initialization methods.\nThis exploitation technique effectively bypasses the application's intended operational logic, as the attacker is essentially using the server's reflection capabilities as a proxy for arbitrary code execution. The missing authorization ensures that no authentication headers or session tokens are required to reach the vulnerable code block.\nThe post-exploitation impact includes the ability to perform operations outside the scope of the intended Nutch functionality. Since the Nutch Server process typically runs with the privileges of the user who started the service, the attacker inherits those permissions, allowing for file system access, network scanning, or full system control. The removal of the Nutch Server in version 1.23 is the only definitive architectural fix, as the vulnerability is deeply tied to the design of the REST interface exposed by the affected versions."
}