Apache Solr远程命令执行漏洞

原创 sauren  2019-10-31 15:51  阅读 402 views 次 评论 22 条

Solr是一个独立的企业级搜索应用服务器,它对外提供类似于Web-service的API接口。用户可以通过http请求,向搜索引擎服务器提交一定格式的xml文件,生成索引;也可以通过Http Get操作提出查找请求,并得到xml格式的返回结果。
该漏洞通过修改Core配置,修改params.resource.loader.enabled参数为Ture,并输入构造好的RCE请求执行命令,利用难度简单,可直接远程执行命令。

执行步骤一:

修改params.resource.loader.enabled参数为Ture

1.png

执行步骤二:

发送payload,得到返回结果。

2.png

 

漏洞检测工具下载(python):

此处为隐藏的内容!
发表评论并刷新,才能查看

 

本文地址:https://www.sk15.net/archives/317.html
版权声明:本文为原创文章,版权归 sauren 所有,欢迎分享本文,转载请保留出处!
NEXT:已经是最新一篇了
高性能云服务器特惠

发表评论


表情

  1. Larrytus
    Larrytus @回复

    Thank you! An abundance of content.
    sertralin

  2. RichardDearp
    RichardDearp @回复

    Reliable postings. Kudos! Order Cialis Soft Cash On Delivery

  3. ErnestLip
    ErnestLip @回复

    You actually said it really well! Amoxicillin Enterobacter

  4. Louishor
    Louishor @回复

    Thanks a lot. I appreciate this! canadian king pharmacy

  5. Tyronemox
    Tyronemox @回复

    With thanks! I appreciate it. Levitra Cheaper Than Cialis

  6. Larrytus
    Larrytus @回复

    You expressed that wonderfully! advair

  7. ErnestLip
    ErnestLip @回复

    Truly plenty of good tips. international drug mart canadian pharmacy online store

  8. Louishor
    Louishor @回复

    Thank you. Helpful stuff. canadian pharcharmy online no precipitation

  9. RichardDearp
    RichardDearp @回复

    Thanks, Loads of forum posts.
    canadian pharmacies

  10. RichardDearp
    RichardDearp @回复

    You said that adequately! https://viagrapython.com/

  11. Larrytus
    Larrytus @回复

    Regards, Ample forum posts!
    doxycycline mono 100mg cap

  12. RichardDearp
    RichardDearp @回复

    Thank you, Terrific information! buy cialis pills

  13. Larrytus
    Larrytus @回复

    You made your point! Monthly Cost Of Neurontin

  14. RichardDearp
    RichardDearp @回复

    Truly many of fantastic information! cialis online

  15. Larrytus
    Larrytus @回复

    Nicely put. Regards. buy fluoxetine

  16. Larrytus
    Larrytus @回复

    Many thanks. A lot of facts!
    global pharmacy canada

  17. Larrytus
    Larrytus @回复

    Seriously tons of helpful info! canadian pharmacies-24h

  18. Larrytus
    Larrytus @回复

    Nicely put, Appreciate it. Sale Metformin Dosage

  19. Larrytus
    Larrytus @回复

    Really lots of excellent tips! Lasix Vs Salix Dosage

  20. Larrytus
    Larrytus @回复

    Fine material. With thanks! Myasthenia Gravis Inderal

  21. Larrytus
    Larrytus @回复

    With thanks. A lot of postings.
    lisinopril

  22. Larrytus
    Larrytus @回复

    You reported it terrifically! celexa for anxiety