PT-2019-8565 · Apache+1 · Apache Solr+1

Published 2019-03-08 · Updated 2020-12-09 · CVE-2017-3164

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 1.3 through 7.6

Description The issue allows a remote attacker with access to the server to make Apache Solr perform an HTTP GET request to any reachable URL, due to the lack of a whitelist mechanism for the shards parameter. This enables Server Side Request Forgery.

Recommendations For Apache Solr versions 1.3 through 7.6, consider restricting access to the shards parameter to minimize the risk of exploitation. As a temporary workaround, restrict the Solr server from making HTTP GET requests to unauthorized URLs until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-3164

GHSA-VRH8-27Q8-FR8F

Affected Products

Apache Solr

Debian

References · 33

• https://security-tracker.debian.org/tracker/source-package/lucene-solr · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3164 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/www-announce/201902.mbox/%3CCAECwjAVjBN%3DwO5rYs6ktAX-5%3D-f5JDFwbbTSM2TTjEbGO5jKKA%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-3164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3164 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3164 · Security Note
• https://osv.dev/vulnerability/GHSA-vrh8-27q8-fr8f · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-3164 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3164 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-3164 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3164 · Vendor Advisory
• https://t.me/cvenotify/6807 · Telegram Post
• https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/75dc651478f9d04505b46d44fe3ac739e7aaf3d7bf1257973685f8f7@%3Cdev.lucene.apache.org%3E · Note
• https://lists.apache.org/thread.html/43026507844ada1ac658ccf7bc939378c13e492fd6538416ce65df39@%3Cdev.lucene.apache.org%3E · Note