Описание
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
It was found that Apache Lucene would accept an object from an unauthenticated user that could be manipulated through subsequent post requests. An attacker could use this flaw to assemble an object that could permit execution of arbitrary code if the server enabled Apache Solr's Config API.
Отчет
The following products are not affected by this flaw, as they do not use the vulnerable functionality of either aspect of the issue. Red Hat JBoss Enterprise Application Platform 6 Red Hat JBoss BPM Suite Red Hat JBoss BRMS Red Hat Enterprise Virtualization Manager Red Hat Single Sign-On 7 Red Hat JBoss Portal Platform 6 Red Hat JBoss Enterprise Application Platform 7 is not affected by this flaw. However, it does ship the vulnerable Lucene class in a dependency to another component. Customers who reuse the lucene-queryparser jar in their applications may be vulnerable to the External Entity Expansion aspect of this flaw. This will be patched in a forthcoming release. Red Hat JBoss Fuse is not affected by this flaw, as it does not use the vulnerable functionality of either aspect of this flaw. Fuse customers who may be running external Solr servers, while not affected from the Fuse side, are advised to secure their Solr servers as recommended in the mitigation provided. The following products ship only the Lucene components relevant to this flaw, and are not vulnerable to the second portion of the vulnerability, the code execution exploit. As such, the impact of this flaw has been determined to be Moderate for these respective products: Red Hat JBoss Data Grid 7 Red Hat Enterprise Linux 6 Red Hat Software Collections 2.4 This issue did not affect the versions of lucene as shipped with Red Hat Enterprise Linux 5. This issue does not affect Elasticsearch as shipped in OpenShift Container Platform.
Меры по смягчению последствий
Until fixes are available, all Solr users are advised to restart their Solr instances with the system parameter -Ddisable.configEdit=true. This will disallow any changes to be made to configurations via the Config API. This is a key factor in this vulnerability, since it allows GET requests to add the RunExecutableListener to the config.
This is sufficient to protect from this type of attack, but means you cannot use the edit capabilities of the Config API until further fixes are in place.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | lucene | Not affected | ||
| Red Hat Enterprise Linux 5 | lucene | Not affected | ||
| Red Hat Enterprise Linux 6 | lucene | Will not fix | ||
| Red Hat Fuse 7 | solr | Not affected | ||
| Red Hat JBoss BRMS 6 | lucene | Not affected | ||
| Red Hat JBoss Data Grid 7 | lucene | Affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | lucene | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | solr | Not affected | ||
| Red Hat JBoss Fuse 6 | Camel | Not affected | ||
| Red Hat JBoss Portal 6 | solr | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
9.8 Critical
CVSS3
10 Critical
CVSS2
Связанные уязвимости
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Remote code execution occurs in Apache Solr before 7.1 with Apache Luc ...
Уязвимость реализации класса RunExecutableListener поискового сервера Apache Solr и библиотеки для полнотекстового поиска Apache Lucene, позволяющая нарушителю выполнить произвольный код
EPSS
9.8 Critical
CVSS3
10 Critical
CVSS2