CVE-2013-6397: Improper Limitation of a Pathname to a Restricted Directory in Apache Solr
Summary
CVE-2013-6397: Improper Limitation of a Pathname to a Restricted Directory in Apache Solr. Affects org.apache.solr:solr-core versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Also tracked for
- lucene-solr · Debian:11
The same CVE-2013-6397 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and distributed search capabilities. SolrResourceLoader is a component in Apache Solr responsible for loading resources such as configuration files and XSLT stylesheets. This vulnerability affects versions of Apache Solr before 4.6.0.
Vulnerability Detail
The vulnerability in SolrResourceLoader allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability. This can be achieved by using a .. (dot dot) or full pathname in the 'tr' parameter of the 'solr/select/' endpoint, when the response writer ('wt' parameter) is set to XSLT. An attacker can leverage this vulnerability in combination with a separate XXE (XML eXternal Entity) vulnerability to gain access to files across restricted network boundaries.
How To Fix
Minimum fixed version
4.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version of Apache Solr is not immediately feasible, a possible workaround is to disable the XSLT response writer by removing it from the 'wt' parameter in the request. This can be done by modifying the Solr configuration or by explicitly specifying a different response writer.
Conclusion
The vulnerability in Apache Solr allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability in SolrResourceLoader. It is recommended to upgrade to Apache Solr version 4.6.0 or later to fix this vulnerability. If immediate upgrading is not possible, disabling the XSLT response writer can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and distributed search capabilities.
SolrResourceLoader is a component in Apache Solr responsible for loading resources such as configuration files and XSLT stylesheets.
The vulnerability allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability. By using a .. (dot dot) or full pathname in the 'tr' parameter of the 'solr/select/' endpoint, when the response writer ('wt' parameter) is set to XSLT, an attacker can access files outside of the intended directory.
A directory traversal vulnerability, also known as path traversal or directory climbing, allows an attacker to access files or directories outside of the intended directory. It occurs when insufficient input validation is performed on user-supplied input that specifies a file or directory path.
To fix this vulnerability, it is recommended to upgrade to Apache Solr version 4.6.0 or later. Updating the Solr dependency in your project's Maven configuration to version 4.6.0 or later should resolve the issue.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
