GHSA-45w3-2hvv-pfxq CVE-2013-6408
XML Injection in Apache Solr
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 11.40%
- Chance of exploitation in the next 30 days. Higher than 96.00% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-91 XML Injection (aka Blind XPath Injection)
- Fix
4.3.1- Upgrade org.apache.solr:solr-core to this version or later
Description
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.solr:solr-core | < 4.3.1 |
4.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.solr:solr-core Maven → 4.3.1
- maven
<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>4.3.1</version></dependency>- gradle
implementation("org.apache.solr:solr-core:4.3.1")
Weakness
CWE-91: XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Packages
Other links
- github.com/apache/lucene-solr/commit/7239a57a51ea0f4d05dd330ce5e15e4f72f72747
- issues.apache.org/jira/browse/SOLR-4881
- rhn.redhat.com/errata/RHSA-2013-1844.html
- rhn.redhat.com/errata/RHSA-2014-0029.html
- svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt
- openwall.com/lists/oss-security/2013/11/29/2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-17558 Improper Input Validation in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| CVE-2019-0193 XML External Entity (XXE) Injection in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| GHSA-qhr7-h655-pw6r Apache Solr has hardcoded credentials in the Basic Authentication setup tool | Critical | Also affects org.apache.solr:solr-core |
| GHSA-vc2w-4v3p-2mqw Apache Solr: Insufficient file-access checking in standalone core-creation requests | High | Also affects org.apache.solr:solr-core |
| GHSA-qr3p-2xj2-q7hq Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin | High | Also affects org.apache.solr:solr-core |
| GHSA-68r2-fwcg-qpm8 Apache Solr vulnerable to Execution with Unnecessary Privileges | Medium | Also affects org.apache.solr:solr-core |
| GHSA-4p5m-gvpf-f3x5 Apache Solr Relative Path Traversal vulnerability | Medium | Also affects org.apache.solr:solr-core |
| GHSA-37vr-vmg4-jwpw Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | High | Also affects org.apache.solr:solr-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor