Solr Search Tool Can Allow Remote Code Execution (RCE) by Default

A security vulnerability affecting the Linux enterprise search tool Apache Solr has been reclassified by Tenable as high severity status.

A security vulnerability affecting the Linux enterprise search tool Apache Solr has been
reclassified by Tenable
as high severity status. It seems that the default configuration of Solr on Solr 8.1.1 and 8.2.0 for Linux (but not for Windows) allows a remote code execution (RCE).
The NoSQL tool has been maintained since 2006 by open-source organization Apache Software Foundation, news organization CNET having donated it after building on Apaches Lucene. The ASF team has
issued an advisory about the situation
.
The team describes the vuln as, If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
The vuln has become recognized as more serious than initially thought when reports of it emerged this past July. It was then thought that it would only allow cybercriminals or other third parties to access monitoring data. However, a full-blown hole was found to exist on port 8983 that would allow RCE to happen.
A revised proof-of-concept has been put up on GitHub showing how such an attack could proceed.
Mitigation for this situation is fairly simple, but may be a bit complicated to implement. The team advises that users should make sure that the effective solr.in.sh file has ENABLE_REMOTE_JMX_OPTS set to false on every Solr node and then restart Solr. The effective solr.in.sh file may reside in /etc/defaults/ or another location depending on the install. As a check, validate that the com.sun.management.jmxremote family of properties are not listed in the Java Properties section of the Solr Admin UI, or configured in a secure way.
Though the team recommends upgrading to version 8.3 because of all the feature modifications they have done, Tenable thinks that 8.3 will still allow the vuln to be active if it is default configured.
Tenable points out that
adding authentication
to an instance may help. They also note that unless the Config API is locked down, an attacker could modify the solrconfig.xml file.
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Solr Search Tool Can Allow Remote Code Execution (RCE) by Default