A critical vulnerability in the Apache Nutch REST API allows unauthenticated remote attackers to achieve full system compromise via unsafe reflection.

The vulnerability involves missing authorization and the use of externally controlled input to select classes, commonly known as unsafe reflection, within the Nutch REST API. Because the API lacks proper access controls, an unauthenticated remote attacker can trigger this flaw to execute arbitrary code on the host server.

The potential for unauthenticated remote code execution poses a catastrophic risk to organizational security, as it allows attackers to gain complete control over the affected server. Given the CVSS score of 9.8, this vulnerability could lead to total data exfiltration, service disruption, and the potential for lateral movement into the internal network.

Immediate Action: Upgrade Apache Nutch to version 1.23 immediately, which removes the vulnerable Nutch Server component entirely.

Proactive Monitoring: Audit server access logs for anomalous REST API requests and monitor system processes for unexpected child spawns or unauthorized command execution.

Compensating Controls: If upgrading is not immediately feasible, restrict network access to the Nutch REST API interface to trusted IP addresses only using firewall rules or a reverse proxy.

Public Exploit Available: No

This vulnerability represents a critical risk to any infrastructure running Apache Nutch. Organizations should prioritize the upgrade to version 1.23 to eliminate the Nutch Server component. If immediate patching is not possible, strict network segmentation is required to prevent unauthorized access to the REST API, as the lack of authentication makes the service trivial to target for opportunistic attackers.