CVE-2018-1308: XML External Entity Expansion (XXE) Vulnerability in Apache Solr
Summary
CVE-2018-1308: There is a XML external entity expansion (XXE) vulnerability in Apache Solr. Affects org.apache.solr:solr-core across 2 version ranges.
>= 1.2, < 6.6.3
>= 7.0.0, < 7.3.0
Fixed in 6.6.3 or 7.3.0, depending on the release line you run. How to fix ↓
Also tracked for
- lucene-solr · Debian:11
The same CVE-2018-1308 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities. Solr's DataImportHandler allows importing data from various sources, including XML files. However, a vulnerability in versions 1.2 to 6.6.2 and 7.0.0 to 7.2.1 of Apache Solr exposes it to XML external entity expansion (XXE) attacks. This vulnerability can be exploited to read arbitrary local files from the Solr server or the internal network using file/ftp/http protocols.
Vulnerability Detail
The XML external entity expansion (XXE) vulnerability in Apache Solr allows an attacker to include external entities in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. By crafting a malicious XML payload, an attacker can trigger the XXE vulnerability and read sensitive files on the server or internal network. This can lead to unauthorized access to sensitive information or further exploitation of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.2, < 6.6.36.6.3 -
>= 7.0.0, < 7.3.07.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to disable the DataImportHandler in the Solr configuration. This can be done by removing or commenting out the relevant configuration entries in the solrconfig.xml file. However, this workaround may impact the functionality of importing data from XML sources.
Conclusion
The XML external entity expansion (XXE) vulnerability in Apache Solr exposes the server to potential unauthorized access and information disclosure. It is crucial to upgrade to a fixed version of Apache Solr to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities.
The DataImportHandler is a Solr component that allows importing data from various sources, including XML files.
An XML external entity (XXE) attack is a type of vulnerability where an attacker can include external entities in an XML document, leading to unauthorized access to sensitive files or information.
This vulnerability can be exploited by crafting a malicious XML payload and sending it to the vulnerable Solr server. By triggering the XXE vulnerability, an attacker can read arbitrary local files from the server or internal network.
Yes, upgrading to a fixed version of Apache Solr (6.6.3 or later for versions 1.2 to 6.6.2, and 7.2.2 or later for versions 7.0.0 to 7.2.1) will patch the XXE vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
