Executive brief
Apache Solr, a popular enterprise search platform, is vulnerable to a security flaw that allows attackers to force the server to make unauthorized web requests. This could be used to probe internal network services that are not normally accessible from the outside or to access sensitive data. Organizations using affected versions should update to a patched release to prevent potential data exposure or internal network reconnaissance.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Solr's 'shards' parameter due to the lack of a whitelist mechanism for destination URLs. A remote, unauthenticated attacker can exploit this by sending a crafted request to the Solr server, forcing it to perform an HTTP GET request to any reachable URL, including internal network resources. This can lead to unauthorized information disclosure or internal port scanning. The vulnerability affects versions 1.3.0 through 7.6.0 and is resolved in version 7.7.0.
Affected products
- Apache solr-core >= 1.3.0, <= 7.6.0
Timeline
- 2019-03-14: advisory: GitHub Advisory published
- 2019-02-01: disclosed: Apache mailing list announcement
- 2019-02-11: patched: Version 7.7.0 released