THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
The authoritative guide on implementing security is in the Solr Reference Guide. This page describes security features in general, but also provides information about CVEs that have been patched or dependencies which do not require a patch for Solr.
| Table of Contents |
|---|
Security Announcements
- 2019-07-31: [CVE-2019-0193] Remote Code Execution via DataImportHandler
- 2019-03-06: CVE-2019-0192 Deserialization of untrusted data via jmx.serviceUrl
- 2019-02-12: CVE-2017-3164 SSRF issue in Apache Solr
- 2018-04-08: CVE-2018-1308: XXE attack through DIH's dataConfig request parameter
- 2017-10-26: CVE-2016-6809 – Arbitrary Code Execution Vulnerability in Apache Tika’s MATLAB Parser bundled with Apache Solr
- 2017-10-18: CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)
- 2017-09-18: CVE-2017-9803: Security vulnerability in kerberos delegation token functionality
- 2017-07-07: CVE-2017-7660: Security Vulnerability in secure inter-node communication in Apache Solr
- 2017-02-15: CVE-2017-3163: Apache Solr ReplicationHandler path traversal attack
| Warning |
|---|
If you believe you have discovered a vulnerability in Lucene or Solr, please follow these ASF guidelines for reporting it. |
...
- SSL support was added in version 4.2 (SolrCloud v4.7).
- Protection of Zookeeper content through ACLs was added in version 5.0
- Authentication and Authorization plugin support was added in 5.2 (SolrCloud only).
- Several bugs in this support were fixed in 5.3, so it's strongly recommended to use 5.3 or later if this feature is desired. The general recommendation is to always use the latest released version.
- Basic Auth & Kerberos plugins and Rule-based Authorization plugin was added in 5.3
There is (as of 5.3) no role-based restrictions on the Admin UI, so be aware that anyone with access to Admin UI will be able to do anything with your system.
...
- Some number of "good guys" have direct access to that Solr instance from their web browsers.
- A "bad guy" knows/guesses the host:port/path of the Solr instance (even though they can not access it directly)
- The bad guy can trick one of the good guy into clicking a maliciously crafted URL, or loading a webpage that contains malicious javascript.
This is because Solr's most basic behavior is to receive updates and deletes via HTTP. If you have a firewall or other security measure restricting Solr's /update handler so it only accepts connections from approved hosts/clients, but you are approved then you could inadvertently be tricked into loading a web page that initiates an HTTP Connection to Solr on your behalf.
...
It works by adding security tokens from the source repositories as metadata on the indexed documents. Then, at query time, a Search Component adds a filter to all queries, matching only documents the logged-in user is allowed to see. ManifoldCF supports AD security out of the box.
Write Your Own RequestHandler or SearchComponent
*Stub - this is incomplete*
...
Solr Versions | Jar or Path | Related CVEs | Date Added | Status & Notes |
7.3.1-7.5.0 |
| 2018-1335 | 6 Jun 2018 | Solr does not run tika-server, so this is not a problem. |
7.3.1-7.5.0 |
| 2018-1338, 2018-1339 | 6 Jun 2018 | These issues would only be exploitable if untrusted files are indexed with SolrCell. This is not recommended in production systems as indicated above. Additionally, Solr upgraded to Tika 1.18 in Solr 7.4. |
4.7.0-7.3.1 |
| 2017-15095, 2017-17485, 2017-7525, 2018-5968, 2018-7489 | 6 Jun 2018 | Jackson was upgraded to 2.9.5 in Solr 7.4. |
7.3.1 |
| 2014-7940, 2016-6293, 2016-7415, 2017-14952, 2017-17484, 2017-7867, 2017-7868 | 6 Jun 2018 | All of these issues apply to the C++ release of ICU and not ICU4J, which is what Lucene uses. |
6.0.0-7.5.0 |
| 2017-14952 | 6 Jun 2018 | Issue applies only to the C++ release of ICU and not ICU4J, which is what Lucene uses. ICU4J is at v63.2 as of Lucene/Solr 7.6.0 |
6.6.1-7.6.0 |
| 6 Jun 2018 | Does not impact Solr because Solr uses Hadoop as a client library. | |
4.9.0-7.5.0 |
| 2014-0114 | 6 Jun 2018 | This is only used at compile time and it cannot be used to attack Solr. Since it is generally unnecessary, the dependency has been removed as of 7.5.0. |
5.5.5, 6.2.0-today |
| 2016-6809, 2018-1335, 2018-1338, 2018-1339 | 6 Jun 2018 | See https://github.com/Gagravarr/VorbisJava/issues/30; reported CVEs are not related to OggVorbis at all. |
~2.9-today |
| 6 Jun 2018 | Only used in Lucene Benchmarks and Solr tests. | |
6.6.2-today |
| 3 Nov 2018 | Solr does not ship a Struts jar. This is a transitive POM listing and not included with Solr (see comment in SOLR-2849). | |
6.5.0-today |
| 3 Nov 2018 | Dependency for Hadoop and Calcite. ?? | |
4.6.0-today |
| 3 Nov 2018 | Used only in DataImportHandler tests and example implementation, which should not be used in production. | |
4.6.0-7.6.0 |
| 2018-1000056 | 31 Dec 2018 | JUnit only used in tests; CVE only refers to a Jenkins plugin not used by Solr. |
4.6.0-today |
| 2018-1000632 | 31 Dec 2018 | Only used in Solr tests. |
5.2.0-today |
| 2017-14868, 2017-14949 | 31 Dec 2018 | Solr should not be exposed outside a firewall where bad actors can send HTTP requests. |
4.6.0-today |
| 2012-2098, 2018-1324, 2018-11771 | 31 Dec 2018 | Only used in test framework and at build time. |
5.4.0-today |
| 2018-10237 | 31 Dec 2018 | Only used with the Carrot2 clustering engine. |
4.6.0-today |
| 2018-10237 | 31 Dec 2018 | ?? |
5.4.0-today |
| 2018-1471 | 3 Jan 2019 | Dependency of Carrot2 and used during compilation, not at runtime (see SOLR-769). |
4.x-today |
| 2018-8088 | 6 Feb 2019 | The reported CVE impacts org.slf4j.ext.EventData, which is not used in Solr. |
...