Apache Solr官网安全更新（2021-12-18）

18 December 2021, CVE-2021-44548: Apache Solr information disclosure vulnerability through DataImportHandler

<br/> <br/> Severity:<br/>Moderate<br/>Versions Affected:<br/>All versions prior to 8.11.1. Affected platforms: Windows.<br/>Description:<br/>An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in:<br/><br/>The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes),<br/>In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution<br/><br/>This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.<br/>Mitigation:<br/>Upgrade to Solr 8.11.1, and/or ensure only trusted clients can make requests to Solr&#39;s DataImport handler.<br/>Credit:<br/>Apache Solr would like to thank LaiHan of Nsfocus security team for reporting the issue<br/>References:<br/>Jira issue SOLR-15826<br/>

Apache Solr 是一个开源的搜索服务器。Solr 使用 Java 语言开发，主要基于 HTTP 和 Apache Lucene 实现。Apache Solr 中存储的资源是以 Document 为对象进行存储的。每个文档由一系列的 Field 构成，每个 Field 表示资源的一个属性。

<p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44548">CVE-2021-44548</a></p>

暂无

暂无

https://lucene.apache.org/solr/news.html