Bug 1736774 (CVE-2019-0193) - CVE-2019-0193 solr: Remote Code Execution via DataImportHandler
Summary: CVE-2019-0193 solr: Remote Code Execution via DataImportHandler
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-0193
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1736775 1784382 2079426
Blocks: 1736776
TreeView+ depends on / blocked
 
Reported: 2019-08-01 23:50 UTC by Laura Pardo
Modified: 2022-05-10 04:41 UTC (History)
43 users (show)

Fixed In Version: solr 8.1.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Apache Solr’s DataImportHandler(DIH). A DIH configuration containing scripts coming from a request's dataConfig parameter allows an attacker to perform remote code execution.
Clone Of:
Environment:
Last Closed: 2020-03-17 16:31:43 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2019-08-01 23:50:47 UTC 
The DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.


References:
https://issues.apache.org/jira/browse/SOLR-13669
Comment 1 Laura Pardo 2019-08-02 00:10:00 UTC 
Created solr3 tracking bugs for this issue:

Affects: fedora-all [bug 1736775]
Comment 2 Joshua Padman 2019-08-12 02:29:57 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse Service Works 6
 * Red Hat Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 3 Chess Hazlett 2019-12-13 21:09:08 UTC 
Mitigation:

Edit solrconfig.xml to configure all DataImportHandler usages with an "invariants" section listing the "dataConfig" parameter set to am empty string, or ensure your network settings are configured so that only trusted traffic communicates with Solr, especially to the DataImportHandler (although this is a best practice regardless) (ref: https://issues.apache.org/jira/browse/SOLR-13669)
Comment 12 Product Security DevOps Team 2020-03-17 16:31:43 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-0193
Comment 15 Paramvir jindal 2022-05-10 04:41:36 UTC 
Marking JDV-6 and EAP-6 as not affected because the affected class is the part of solr-dataimporthandler.jar artifact which is not shipped with EAP-6 and JDV-6 distributions.
Note You need to log in before you can comment on or make changes to this bug.