Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-6809

CVE-2016-6809:
Apache Tika allows Java code execution for serialized objects embedded in MATLAB files

9.8

CVSS Score

Basic Information

CVE ID
CVE-2016-6809
GHSA ID
GHSA-j8g6-2wh7-6439
EPSS Score
-
CWE
CWE-502
Published
10/17/2018
Updated
4/12/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.tika:tika-coremaven< 1.141.14

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsafe deserialization via JMatIO's MatFileReader in Apache Tika's MatParser. The patch added a static block in MatParser.java to disable object deserialization (MatFileReader.setAllowObjectDeserialization(false)), which was missing in vulnerable versions. The parse method is the entry point that triggers JMatIO's deserialization logic without this safeguard, making it the vulnerable function. The absence of the static initializer in pre-1.14 versions left the deserialization flag enabled by default, leading to CWE-502 exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** Tik* ***or* *.** *llows J*v* *o** *x**ution *or s*ri*liz** o*j**ts *m****** in M*TL** *il*s. T** issu* *xists ****us* Tik* invok*s JM*tIO to *o n*tiv* **s*ri*liz*tion.

Reasoning

T** vuln*r**ility st*ms *rom uns*** **s*ri*liz*tion vi* JM*tIO's M*t*il*R****r in *p**** Tik*'s M*tP*rs*r. T** p*t** ***** * st*ti* *lo*k in M*tP*rs*r.j*v* to *is**l* o*j**t **s*ri*liz*tion (M*t*il*R****r.s*t*llowO*j**t**s*ri*liz*tion(**ls*)), w*i**