CVE-2021-28163: Apache Solr - Symlink Webapps Directory Deployment Vulnerability
Summary
CVE-2021-28163: In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadverte... Affects solr versions >= 8.8.1, < 8.8.2. Fixed in 8.8.2. How to fix ↓
Also tracked for
- org.eclipse.jetty:jetty-deploy · Maven
- jetty9 · Debian:11
The same CVE-2021-28163 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities for websites and applications. Solr uses Jetty as its default web server. Jetty is a Java-based HTTP server and servlet container. This vulnerability affects versions 8.8.1 of Apache Solr.
Vulnerability Detail
The vulnerability (CVE-2021-28163) exists in Eclipse Jetty versions 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1. When a user uses a webapps directory that is a symlink, the contents of the webapps directory are deployed as a static webapp. This inadvertently serves the webapps themselves and anything else that might be in that directory. An attacker could exploit this vulnerability to access sensitive information or execute arbitrary code on the server.
How To Fix
Minimum fixed version
8.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can ensure that the webapps directory is not a symlink. Instead, use a regular directory for deploying web applications.
Conclusion
The vulnerability (CVE-2021-28163) in Apache Solr allows an attacker to deploy the contents of a symlinked webapps directory as a static webapp, potentially exposing sensitive information or enabling arbitrary code execution. It is crucial to upgrade to a non-vulnerable version of Apache Solr or Jetty and avoid using symlinked webapps directories. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for solr →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and indexing capabilities for websites and applications.
Eclipse Jetty is a Java-based HTTP server and servlet container. It is used as the default web server in Apache Solr.
A symlink, short for symbolic link, is a file that acts as a pointer to another file or directory. It allows multiple paths to refer to the same file or directory.
This vulnerability could allow an attacker to access sensitive information or execute arbitrary code on the server hosting Apache Solr.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache Solr installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if any open-source vulnerabilities are detected.
Related vulnerabilities
Recent vulnerabilities recorded for solr.
