![]() ![]() Before Solr 6 this was no problem, as config files were not accessible through the APIs. ![]() Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. ![]() Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader) usage of absolute URLs is denied. Once upgrade is complete, no other steps are required. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. In addition, Xinclude functionality provided in these config files is also affected in a similar way. This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin). Solr bypasses all authorization settings for such requests. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |