Apache Solr and Apache Lucene are open-source search platforms that allow businesses to incorporate full-text search functionality into their applications. Solr is built on top of Lucene and provides enterprise-level indexing, search, and analytics capabilities. These products can be used to enable search features within web applications, e-commerce sites, and other digital interfaces.
One major vulnerability that was detected in Apache Solr and Lucene is CVE-2017-12629. This vulnerability allows attackers to execute remote code by exploiting the XML External Entity (XXE) expansion. Through the use of a Config API add-listener command, the attacker can reach the RunExecutableListener class in versions of Solr before 7.1 and versions of Lucene before 7.1.
When exploited, this vulnerability can lead to serious consequences for businesses that rely on Solr and Lucene to power their search functionality. Attackers can use XXE to upload malicious data through the /upload request handler or execute code through the RunExecutableListener to gain access to sensitive data or perform malicious actions on the server. This can lead to significant financial loss, reputational damage, and legal consequences.
At s4e.io, we offer pro features that can help businesses identify vulnerabilities in their digital assets quickly and easily. Our platform provides real-time threat intelligence and actionable insights to help protect against cyber threats such as CVE-2017-12629. By using our services, businesses can ensure that their applications and systems are secure against known vulnerabilities and emerging threats.
REFERENCES
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E
- http://openwall.com/lists/oss-security/2017/10/13/1
- http://www.securityfocus.com/bid/101261
- https://access.redhat.com/errata/RHSA-2017:3123
- https://access.redhat.com/errata/RHSA-2017:3124
- https://access.redhat.com/errata/RHSA-2017:3244
- https://access.redhat.com/errata/RHSA-2017:3451
- https://access.redhat.com/errata/RHSA-2017:3452
- https://access.redhat.com/errata/RHSA-2018:0002
- https://access.redhat.com/errata/RHSA-2018:0003
- https://access.redhat.com/errata/RHSA-2018:0004
- https://access.redhat.com/errata/RHSA-2018:0005
- https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html
- https://s.apache.org/FJDl
- https://twitter.com/ApacheSolr/status/918731485611401216
- https://twitter.com/joshbressers/status/919258716297420802
- https://twitter.com/searchtools_avi/status/918904813613543424
- https://usn.ubuntu.com/4259-1/
- https://www.debian.org/security/2018/dsa-4124
- https://www.exploit-db.com/exploits/43009/
To protect against this vulnerability, businesses using Solr and Lucene should take the following precautions:
- Upgrade to the latest version of Solr and Lucene, which contain fixes for CVE-2017-12629
- Disable the XML Query Parser if it is not needed for the application
- Configure the server to restrict access to the Config API to authorized users only
- Monitor logs for suspicious activity and network traffic
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →