====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN145
_____________________________________________________________________

DATE                : 12/04/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Solr versions prior to
                                    6.6.3, 7.3.0.

=====================================================================
https://mail-archives.apache.org/mod_mbox/www-announce/201804.mbox/%3C000001d3cf68%245ac69af0%241053d0d0%24%40apache.org%3E
_____________________________________________________________________

CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request
parameter

Severity: Major

Vendor:
The Apache Software Foundation

Versions Affected:
Solr 1.2 to 6.6.2
Solr 7.0.0 to 7.2.1

Description:
The details of this vulnerability were reported to the Apache Security
mailing list.

This vulnerability relates to an XML external entity expansion (XXE) in
the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It
can be used as XXE using file/ftp/http protocols in order to read
arbitrary local files from the Solr server or the internal network. See
[1] for more details.

Mitigation:
Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases
both of which address the vulnerability. Once upgrade is complete, no
other steps are required. Those releases disable external entities in
anonymous XML files passed through this request parameter.

If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are
advised to disable data import handler in their solrconfig.xml file and
restart their Solr instances. Alternatively, if Solr instances are only
used locally without access to public internet, the vulnerability cannot
be used directly, so it may not be required to update, and instead
reverse proxies or Solr client applications should be guarded to not
allow end users to inject `dataConfig` request parameters. Please refer
to [2] on how to correctly secure Solr servers.

Credit:
Mai XinagNongYu

References:
[1] https://issues.apache.org/jira/browse/SOLR-11971
[2] https://wiki.apache.org/solr/SolrSecurity


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================