[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CABEwPvFHSuV=-exfjiCedkJrEvo6Kvc0S72nsze7x1+kJ-nLhA@mail.gmail.com>
Date: Thu, 1 Aug 2019 00:25:42 +0200
From: David Smiley <dsmiley@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2019-0193] Apache Solr, Remote Code Execution via DataImportHandler
The DataImportHandler, an optional but popular module to pull in data from
databases and other sources, has a feature in which the whole DIH
configuration can come from a request's "dataConfig" parameter. The debug
mode of the DIH admin screen uses this to allow convenient debugging /
development of a DIH config. Since a DIH config can contain scripts, this
parameter is a security risk. Starting with version 8.2.0 of Solr, use of
this parameter requires setting the Java System property
"enable.dih.dataConfigParam" to true.
Mitigations:
* Upgrade to 8.2.0 or later, which is secure by default.
* or, edit solrconfig.xml to configure all DataImportHandler usages with an
"invariants" section listing the "dataConfig" parameter set to am empty
string.
* Ensure your network settings are configured so that only trusted traffic
communicates with Solr, especially to the DIH request handler. This is a
best practice to all of Solr.
Credits:
* Michael Stepankin (JPMorgan Chase)
References:
* https://issues.apache.org/jira/browse/SOLR-13669
* https://cwiki.apache.org/confluence/display/solr/SolrSecurity
Please direct any replies as either comments in the JIRA issue above or to
solr-user@...ene.apache.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
