Apache Solr XXE Vulnerability in lucene-solr Package - CVE-2012-6612
Summary
CVE-2012-6612: The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with... Affects lucene-solr versions < 3.6.2+dfsg-2. Fixed in 3.6.2+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and provides powerful full-text search capabilities. The lucene-solr package is essential for integrating Solr functionalities into applications. However, prior to version 4.1, it was susceptible to an XML External Entity (XXE) vulnerability, which could be exploited by remote attackers to manipulate XML data.
Vulnerability Detail
The vulnerability identified as CVE-2012-6612 affects the UpdateRequestHandler for XSLT and the XPathEntityProcessor in Apache Solr versions before 4.1. This issue arises from the improper handling of XML data containing external entity declarations combined with entity references. Attackers can exploit this vulnerability to potentially gain unauthorized access to sensitive data or execute arbitrary code, leading to severe security breaches.
How To Fix
Minimum fixed version
3.6.2+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lucene-solrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the processing of external entities in your XML parser configuration. This can be done by modifying the XML parsing settings to prevent the inclusion of external entities, thus reducing the risk of exploitation.
Conclusion
The CVE-2012-6612 vulnerability in the lucene-solr package poses significant risks to applications using Apache Solr prior to version 4.1. It is essential to upgrade to the fixed version or implement workarounds to safeguard against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for lucene-solr →
FAQ
CVE-2012-6612 is a vulnerability in Apache Solr that allows remote attackers to exploit XML External Entity (XXE) issues, potentially leading to unauthorized access or code execution.
The vulnerability affects all versions of the lucene-solr package prior to 4.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, potential data manipulation, or execution of arbitrary code on the server.
Yes, you can mitigate the risk by disabling external entity processing in your XML parser configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for lucene-solr.
