Bug 1736774 (CVE-2019-0193)

Summary:	CVE-2019-0193 solr: Remote Code Execution via DataImportHandler
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dosoudil, drieden, extras-orphan, ggaughan, gvarsami, iweiss, janstey, jawilson, jcoleman, jochrist, jolee, jperkins, jschatte, jstastny, kconner, krathod, kwills, ldimaggi, lgao, msochure, msvehla, nwallace, pmackay, psotirop, puntogil, rguimara, rsvoboda, rwagner, smaestri, tcunning, tkirby, tom.jenkinson, twalsh, vhalbert, ymittal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	solr 8.1.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Apache Solr’s DataImportHandler(DIH). A DIH configuration containing scripts coming from a request's dataConfig parameter allows an attacker to perform remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-17 16:31:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1736775, 1784382, 2079426
Bug Blocks:	1736776

Description Laura Pardo 2019-08-01 23:50:47 UTC

The DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.


References:
https://issues.apache.org/jira/browse/SOLR-13669

Comment 1 Laura Pardo 2019-08-02 00:10:00 UTC

Created solr3 tracking bugs for this issue:

Affects: fedora-all [bug 1736775]

Comment 2 Joshua Padman 2019-08-12 02:29:57 UTC

This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse Service Works 6
 * Red Hat Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 3 Chess Hazlett 2019-12-13 21:09:08 UTC

Mitigation:

Edit solrconfig.xml to configure all DataImportHandler usages with an "invariants" section listing the "dataConfig" parameter set to am empty string, or ensure your network settings are configured so that only trusted traffic communicates with Solr, especially to the DataImportHandler (although this is a best practice regardless) (ref: https://issues.apache.org/jira/browse/SOLR-13669)

Comment 12 Product Security DevOps Team 2020-03-17 16:31:43 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-0193

Comment 15 Paramvir jindal 2022-05-10 04:41:36 UTC

Marking JDV-6 and EAP-6 as not affected because the affected class is the part of solr-dataimporthandler.jar artifact which is not shipped with EAP-6 and JDV-6 distributions.