This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Apache Solr < 4.6 has a **Path Traversal** flaw. <br>๐ฅ **Consequences**: Attackers read **arbitrary files** via the `tr` parameter. Sensitive data leaks! ๐
Q2Root Cause? (CWE/Flaw)
๐ก๏ธ **Root Cause**: Improper input validation on the `tr` parameter. Allows **directory traversal characters** (e.g., `../`) or full paths. CWE: Path Traversal. ๐ณ๏ธ
Q3Who is affected? (Versions/Components)
๐ฅ **Affected**: Apache Solr versions **before 4.6**. Based on Lucene. ๐ฆ
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Hackers Can**: Read **any file** on the server. Expose **sensitive info** (configs, keys, logs). No admin rights needed for the read! ๐
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **LOW**. Remote exploitation. No auth required mentioned. Just send a crafted request with `tr=../../etc/passwd`. ๐
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ข **Public Exp**: Yes. References include Secunia (55730) and SecurityFocus (63935). Agarri.fr has a detailed blog on exploiting it. ๐
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for Solr instances. Test the `tr` parameter with `../` payloads. Check if server returns file contents instead of errors. ๐งช
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: Yes. Patched in **Apache Solr 4.6**. See JIRA SOLR-4882. ๐ ๏ธ
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Upgrade immediately! If stuck, **block external access** to the Solr port. Restrict network access to trusted IPs only. ๐ซ