From announce-return-4508-archive-asf-public=cust-asf.ponee.io@apache.org Sun Apr 8 21:58:27 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id 92C85180638 for ; Sun, 8 Apr 2018 21:58:27 +0200 (CEST) Received: (qmail 29690 invoked by uid 500); 8 Apr 2018 19:58:24 -0000 Mailing-List: contact announce-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list announce@apache.org Delivered-To: moderator for announce@apache.org Received: (qmail 57554 invoked by uid 99); 8 Apr 2018 18:35:25 -0000 From: "Uwe Schindler" To: , , , Cc: , "'security'" , Subject: [SECURITY] CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter Date: Sun, 8 Apr 2018 20:35:18 +0200 Message-ID: <000001d3cf68$5ac69af0$1053d0d0$@apache.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdPPY8jq6okC7rdzSF2E85d3JdrugA== Content-Language: de CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request = parameter Severity: Major Vendor: The Apache Software Foundation Versions Affected: Solr 1.2 to 6.6.2 Solr 7.0.0 to 7.2.1 Description: The details of this vulnerability were reported to the Apache Security = mailing list.=20 This vulnerability relates to an XML external entity expansion (XXE) in = the `&dataConfig=3D` parameter of Solr's DataImportHandler. It = can be used as XXE using file/ftp/http protocols in order to read arbitrary = local files from the Solr server or the internal network. See [1] for more = details. Mitigation: Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases = both of which address the vulnerability. Once upgrade is complete, no other = steps are required. Those releases disable external entities in anonymous XML = files passed through this request parameter.=20 If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are advised to disable data import handler in their solrconfig.xml file and restart their Solr instances. Alternatively, if Solr instances are only = used locally without access to public internet, the vulnerability cannot be = used directly, so it may not be required to update, and instead reverse = proxies or Solr client applications should be guarded to not allow end users to = inject `dataConfig` request parameters. Please refer to [2] on how to correctly secure Solr servers. Credit: =E9=BA=A6 =E9=A6=99=E6=B5=93=E9=83=81 References: [1] https://issues.apache.org/jira/browse/SOLR-11971 [2] https://wiki.apache.org/solr/SolrSecurity ----- Uwe Schindler uschindler@apache.org=20 ASF Member, Apache Lucene PMC / Committer Bremen, Germany http://lucene.apache.org/