PT-2018-18391 · Apache · Apache Solr

Ishan Chattopadhyaya + 1 · Published 2018-07-05 · Updated 2019-03-29 · CVE-2018-8026

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.0.0 through 6.6.4 Apache Solr versions 7.0.0 through 7.3.1

Description: The issue relates to an XML external entity expansion (XXE) in Solr config files, such as currency.xml, enumsConfig.xml, and TIKA parsecontext config file, which can be exploited to read arbitrary local files from the Solr server or the internal network using file/ftp/http protocols. The Xinclude functionality in these config files is also affected. The manipulated files can be uploaded as configsets using Solr's API.

Recommendations: For Apache Solr versions 6.0.0 through 6.6.4, update to a version outside of this range to mitigate the risk. For Apache Solr versions 7.0.0 through 7.3.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Solr API to minimize the risk of exploitation. Avoid using the Xinclude functionality in Solr config files until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-8026

GHSA-7PX3-6F6G-HXCJ

Affected Products

Apache Solr

References · 12

• 🔥 https://issues.apache.org/jira/browse/SOLR-12450 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8026 · Security Note
• https://mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8026 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7px3-6f6g-hxcj · Vendor Advisory
• https://github.com/apache/lucene-solr/commit/e5407c5a9710247e5f728aae36224a245a51f0b · Note
• https://github.com/apache/lucene-solr/commit/3aa6086ed99fa7158d423dc7c33dae6da466b09 · Note
• https://github.com/apache/lucene-solr/commit/1880d4824e6c5f98170b9a00aad1d437ee2aa12 · Note
• https://github.com/apache/lucene-solr/commit/d1baf6ba593561f39e2da0a71a8440797005b55 · Note
• https://github.com/advisories/GHSA-7px3-6f6g-hxcj · Note
• http://securityfocus.com/bid/104690 · Note
• https://security.netapp.com/advisory/ntap-20190307-0002 · Note