严重 Apache Solr configset api upload/create 未授权访问漏洞(CVE-2020-13957)

CVE编号

CVE-2020-13957

利用情况

EXP 已公开

补丁情况

官方补丁

披露时间

2020-10-14
该漏洞EXP已公开传播,漏洞利用成本极低,建议您立即关注并修复。
漏洞描述
2020年10月13日,阿里云应急响应中心监测到Apache Solr发布安全更新,其中修复了CVE-2020-13957 Apache Solr configset upload文件上传漏洞。攻击者通过构造特定的请求,成功利用该漏洞可直接获取服务器权限。
解决建议
1. 升级至安全版本

2. 如果未使用ConfigSets API,请禁用UPLOAD命令,将系统属性: configset.upload.enabled 为 false ,可参考官方文档:https://lucene.apache.org/solr/guide/8_6/configsets-api.html。

3. 增加身份验证/授权,可参考官方文档:https://lucene.apache.org/solr/guide/8_6/authentication-and-authorization-plugins.html

4. 使用在SOLR-14663中提到的补丁程序:https://issues.apache.org/jira/browse/SOLR-146634。

5. 禁止Solr API 以及管理 UI 直接对公网开放。设置防火墙,以便只允许受信任的计算机和人员访问。
参考链接
https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a...
https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a...
https://lists.apache.org/thread.html/r1c783d3d81ba62f3381a17a4d6c826f7dead3a1...
https://lists.apache.org/thread.html/r1c783d3d81ba62f3381a17a4d6c826f7dead3a1...
https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6b...
https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6b...
https://lists.apache.org/thread.html/r2236fdf99ac3efbfc36c2df96d3a88f822baa6f...
https://lists.apache.org/thread.html/r2236fdf99ac3efbfc36c2df96d3a88f822baa6f...
https://lists.apache.org/thread.html/r226c1112bb41e7cd427862d875eff9877a20a40...
https://lists.apache.org/thread.html/r2a6600fe9afd502c04d26fd112823ec3f3c3ad1...
https://lists.apache.org/thread.html/r2f8d33a4de07db9459fb2a98a1cd39747066137...
https://lists.apache.org/thread.html/r2f8d33a4de07db9459fb2a98a1cd39747066137...
https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd999949...
https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd999949...
https://lists.apache.org/thread.html/r3da9895cea476bcee2557531bebd4e8f6f367dc...
https://lists.apache.org/thread.html/r4ca8ba5980d9049cf3707798aa3116ee76c1582...
https://lists.apache.org/thread.html/r4ca8ba5980d9049cf3707798aa3116ee76c1582...
https://lists.apache.org/thread.html/r5557641fcf5cfd99260a7037cfbc8788fb546b7...
https://lists.apache.org/thread.html/r5557641fcf5cfd99260a7037cfbc8788fb546b7...
https://lists.apache.org/thread.html/r622a043c2890327f8a4aea16b131e8a7137a282...
https://lists.apache.org/thread.html/r7512ae552cd9d14ab8b1bc0a7e95f2ec52ae853...
https://lists.apache.org/thread.html/r7512ae552cd9d14ab8b1bc0a7e95f2ec52ae853...
https://lists.apache.org/thread.html/r853fdc6d0b91d5e01a26c7bd5becb044ad775a2...
https://lists.apache.org/thread.html/r853fdc6d0b91d5e01a26c7bd5becb044ad775a2...
https://lists.apache.org/thread.html/r8b1782d42d0a4ce573495d5d9345ad328d652c6...
https://lists.apache.org/thread.html/r8b1782d42d0a4ce573495d5d9345ad328d652c6...
https://lists.apache.org/thread.html/r999f828e6e37d9e825e207471cbfd2681c3befc...
https://lists.apache.org/thread.html/r999f828e6e37d9e825e207471cbfd2681c3befc...
https://lists.apache.org/thread.html/r9d7356f209ee30d702b6a921c866564eb2e291b...
https://lists.apache.org/thread.html/r9d7356f209ee30d702b6a921c866564eb2e291b...
https://lists.apache.org/thread.html/rb1de6ba50a468e9baff32a249edaa08f6bcec7d...
https://lists.apache.org/thread.html/rb1de6ba50a468e9baff32a249edaa08f6bcec7d...
https://lists.apache.org/thread.html/rb2f1c7fd3d3ea719dfac4706a80e6affddecae8...
https://lists.apache.org/thread.html/rf1a32f00017e83ff29a74be2de02e28e4302ddd...
https://mail-archives.us.apache.org/mod_mbox/www-announce/202010.mbox/%3CCAEC...
https://security.netapp.com/advisory/ntap-20201023-0002/
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 apache solr * From
(including)
6.6.0
Up to
(including)
6.6.6
运行在以下环境
应用 apache solr * From
(including)
7.0.0
Up to
(including)
7.7.3
运行在以下环境
应用 apache solr * From
(including)
8.0.0
Up to
(including)
8.6.2
运行在以下环境
系统 debian_10 lucene-solr * Up to
(excluding)
3.6.2+dfsg-20+deb10u2
运行在以下环境
系统 debian_11 lucene-solr * Up to
(excluding)
3.6.2+dfsg-24
运行在以下环境
系统 debian_12 lucene-solr * Up to
(excluding)
3.6.2+dfsg-26
运行在以下环境
系统 ubuntu_20 lucene-solr * Up to
(excluding)
0
阿里云评分
9.6
  • 攻击路径
    远程
  • 攻击复杂度
    容易
  • 权限要求
    无需权限
  • 影响范围
    全局影响
  • EXP成熟度
    EXP 已公开
  • 补丁情况
    官方补丁
  • 数据保密性
    数据泄露
  • 数据完整性
    传输被破坏
  • 服务器危害
    服务器失陷
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-862 授权机制缺失
CWE-863 授权机制不正确
阿里云安全产品覆盖情况