Apache Solr velocity Remote Code Execution Vulnerability Handling Guide

Vulnerability Description

On October 30, @_S00pY disclosed the exploitation of Apache Solr Remote Code Execution Vulnerability, which allows attackers to implement remote code execution via velocity templates. After testing, the vulnerability can be successfully triggered, and no official security patch has been released.

This vulnerability needs to be triggered in two steps. First, the attacker needs to modify the “params.Resource.Loader.Enabled” configuration item to True through the config API, and then complete the vulnerability trigger by sending a malicious velocity template.

Some POC codes are as follows:

After successful utilization, arbitrary commands can be executed on the server.

Scope of Impact

Affected Versions

• Apache Solr <= 8.2.0 (versions with config API may be affected by this vulnerability)

Vulnerability Detection

• Manual Test

If any of the following conditions are met, the current system may be affected by this vulnerability.

1. Access http:/ /hostname /Solr/nstance name /config and find that the config API is open.
2. A configfollay.json file exists in the instance configuration directory, under which the configuration item “params.Resource.Loader.Enabled”:”true” can be found. By default, there is no configfollay.json file.

3. In the global configuration file solrconfig.xml, the configuration item “params.resource.loader.enabled” is “true”.

Vulnerability Mitigation

• Product Protection

Users deployed with NIPS can protect against this vulnerability by using protection rule 23982.

• Workaround

1. Users can disable access to / Solr / instance name / config by access control.
2. If ” params.resource.loader.enabled:â€true†exists in the configloverlay.json configuration file, change “true†to “falseâ€.

3. If the following configuration <bool name=”params.resource.loader.enabled”>true</bool> exists in the velocityresponsewriter in the solrconfig.xml configuration file, modify it to “falseâ€.

4. Add security authentication. For detailed configuration methods, please refer to the document released by Apache:

http://lucene.apache.org/solr/guide/8_2/basic-authentication-plugin.html#basic-authentication-plugin

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Information Technology Co. Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.