Path Traversal Vulnerability in Apache Solr (CVE-2017-3163)
Summary
CVE-2017-3163: When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. Affects lucene-solr across 9 version ranges.
< 3.6.2+dfsg-11
< 43ab70147eb494324a1410f7a9f16a896a59bc6f
< 48c80f91b8e5cd9b3a9b48e6184bd53e7619e7e3
< 764d0f19151dbff6f5fcd9fc4b2682cf934590c5
< 4726c5b2d2efa9ba160b608d46a977d0a6b83f94
< 8655b97b27d8da470c8235683af11a8b85a2b10f
< a66a44513ee8191e25b477372094bfa846450316
< bbe4b08cc1fb673d0c3eb4b8455f23ddc1364124
< c7510a0fdd93329ec04c853c8557f4a3f2309eaf
Fixed in 3.6.2+dfsg-11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and provides distributed indexing, replication, and load-balanced querying. Solr is widely used for enterprise search applications, enabling users to search and retrieve data efficiently. However, certain versions of Solr are vulnerable to a path traversal issue that can expose sensitive files to unauthorized access.
Vulnerability Detail
The vulnerability arises from the Index Replication feature in Apache Solr, where nodes can pull index files from a master node via an HTTP API that accepts file names. In versions prior to 5.5.4 and 6.x before 6.4.1, the file name was not properly validated, allowing attackers to craft requests that exploit path traversal. This could lead to unauthorized access to any file readable by the Solr server process, posing significant security risks, especially if the server is not adequately protected by firewalls or authentication mechanisms.
How To Fix
Minimum fixed version
3.6.2+dfsg-11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lucene-solrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing firewall rules to restrict access to the Solr HTTP API, ensuring that only trusted clients can communicate with the Solr server. Additionally, review and tighten authentication mechanisms to limit access to sensitive operations.
Conclusion
CVE-2017-3163 is a significant vulnerability in Apache Solr that can lead to unauthorized file access due to improper validation of file names in the Index Replication feature. It is crucial to upgrade to the latest versions to mitigate this risk. For those unable to upgrade immediately, implementing strict access controls is recommended.
See every vulnerability recorded for lucene-solr →
FAQ
CVE-2017-3163 is a vulnerability in Apache Solr that allows for path traversal, potentially exposing sensitive files to unauthorized users.
Versions of Apache Solr prior to 5.5.4 and 6.x before 6.4.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-3163 is 7.5, indicating a high severity level.
If you cannot upgrade immediately, implement firewall rules to restrict access to the Solr API and tighten authentication mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for lucene-solr.
