Vulnerability Description
On November 18, local time, Apache Software Foundation (ASF) released an official security bulletin to reveal a remote code execution vulnerability (CVE-2019-12409) in Apache Solr. This vulnerability exists and can bring security risks because the configuration item ENABLE_REMOTE_JMX_OPTS in the configuration file solr.in.sh is enabled by default.
If you use the default configuration file solr.in.sh from the affected Solr release, JMX monitoring will be enabled and exposed on the RMI port (default is 18983), without any authentication. If this port is opened for inbound traffic in your firewall, anyone with access to your Solr nodes will be able to access JMX and can upload malicious code to execute on the Solr server. Please check and fix the vulnerability.
References:
https://lucene.apache.org/solr/news.html
https://issues.apache.org/jira/browse/SOLR-13647
Scope of Impact
Affected Versions
Apache Solr 8.1.1
Apache Solr 8.2.0
Note: Only Solr on Linux systems is vulnerable, but not affected on Windows systems.
Vulnerability Detection
Manual Detection
On the dashboard of the Solr background, you can view the current Solr version information. If the Solr version is vulnerable, there may be security risks.
If the configuration item ENABLE_REMOTE_JMX_OPTS in solr.in.sh is true, Solr may be vulnerable.
Vulnerability Protection
At present, ASF has not released a new version to fix the vulnerability. Affected users are advised to visit the following website to obtain the latest updates immediately after they are available:
https://lucene.apache.org/solr/
Temporary Mitigation Measures
ASF officially provides the following mitigation measures:
- Change the configuration item “ENABLE_REMOTE_JMX_OPTS”=”true” in the configuration file solr.in.sh in the /bin folder in theSolr installation directory to “false”, and then restart Solr.
- You should verify that the related property information of “com.sun.management.jmxremote*” is not included in the “Java Properties” option in the administrator interface of Solr.
- Restrict public network access to Solr by allowing only trusted traffic to establish communication with Solr.
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).
A wholly owned subsidiary of NSFOCUS Information Technology Co. Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.
