CVE-2019-12409 PoC — Apache Solr 代码问题漏洞

Description

CVE-2019-12409: RCE Vulnerability Due to Bad Defalut Config in Apache Solr

介绍

# CVE-2019-12409: RCE Vulnerability Due to Bad Defalut Config in Apache Solr

The 8.1.1 and 8.2.0 releases of Apache Solr contains insecure setting in the default solr.in.sh configuration file shipping with Solr.
The setting that result in this vulnerability are:

In "solr.in.sh":
- ENABLE_REMOTE_JMX_OPTS="true" (Enables the JMX Service)

In "solr.cmd":
- -Dcom.sun.management.jmxremote.local.only=false (Allows Remote Access to JMX)
- -Dcom.sun.management.jmxremote.authenticate=false (Does not Require Valid Credentials)

**Note**: Windows users are not affected.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://issues.apache.org/jira/browse/SOLR-13647).

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2019-12409/blob/main/Solr%20-%20CVE-2019-12409.pdf).

### Additional Information:

[PoC for exploiting CVE-2019-12409 using mjet](https://github.com/jas502n/CVE-2019-12409)

Another alternative tool for exploiting CVE-2019-12409 is [beanshooter](https://github.com/qtc-de/beanshooter).

文件快照

备注