XML External Entity Expansion Vulnerability in Apache Solr (CVE-2018-1308)
Summary
CVE-2018-1308: This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig= parameter of Solr's DataImportHandler. Affects lucene-solr across 3 version ranges.
< 3.6.2+dfsg-12
>= 3ba304b29825a94249c5145b3f5061e87b87d8f8, <= b2b6438b37073bee1fca40374e85bf91aa457c0b
>= 73c84accbd6f15a11cd97626991d7d59d2e5cbdb, <= df4de29b55369876769bb741d687e47b67ff9613
Fixed in 3.6.2+dfsg-12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and offers features such as full-text search, faceted search, and real-time indexing. The vulnerability in question affects versions 1.2 to 6.6.2 and 7.0.0 to 7.2.1 of Solr's DataImportHandler, specifically through the &dataConfig=<inlinexml> parameter, which can be exploited to read arbitrary files from the server.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1308, arises from an XML external entity (XXE) expansion issue in Apache Solr. This flaw allows attackers to leverage the &dataConfig=<inlinexml> parameter to perform XXE attacks using file, ftp, or http protocols. Consequently, this can lead to unauthorized access to sensitive files on the Solr server or within the internal network, posing significant security risks.
How To Fix
Minimum fixed version
3.6.2+dfsg-12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lucene-solrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the DataImportHandler or restrict access to the affected parameter until an upgrade can be performed. Additionally, ensure that your XML parser is configured to disable external entity processing.
Conclusion
CVE-2018-1308 is a critical vulnerability in Apache Solr that can lead to unauthorized file access through XML external entity expansion. It is essential for users of affected versions to upgrade to a secure version to protect their systems from potential exploitation.
See every vulnerability recorded for lucene-solr →
FAQ
CVE-2018-1308 is a vulnerability in Apache Solr that allows for XML external entity expansion, potentially leading to unauthorized file access.
The vulnerability affects Apache Solr versions 1.2 to 6.6.2 and 7.0.0 to 7.2.1.
Exploitation of this vulnerability can allow attackers to read arbitrary files from the server, leading to data breaches and loss of confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2018-1308 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for lucene-solr.
