漏洞描述
Log4j是Apache的一个开源项目，该漏洞产生的原因在于Log4j在记录日志的过程中会对日志内容进行判断，如果内容中包含了${，则Log4j会认为此字符属于JNDI远程加载类的地址。apachesolr 使用了该项目进行记录日志，攻击者通过构造恶意的代码即可利用该漏洞，从而导致服务器权限丢失
apache solr system log4j 远程命令执行
PoC代码
暂无相关漏洞推荐
- CVE-2019-17558: Apache Solr Velocity Template RCE
- solr-file-read: Apache Solr <= 8.8.1 Arbitrary File Read
- Apache Solr /solr/admin/cores XML 外部实体注入漏洞（CVE-2017-12629）
- POC CVE-2017-12629: Apache Solr <= 7.1 - XML Entity Injection
- POC CVE-2019-0192: Apache Solr - Deserialization of Untrusted Data
- POC CVE-2019-0193: Apache Solr DataImportHandler <8.2.0 - Remote Code Execution
- POC CVE-2019-17558: Apache Solr <=8.3.1 - Remote Code Execution
- POC CVE-2021-27905: Apache Solr <=8.8.1 - Server-Side Request Forgery
- POC CVE-2023-50290: Apache Solr - Host Environment Variables Leak via Metrics API
- POC CVE-2024-45216: Apache Solr - Authentication Bypass
- POC CVE-2017-12629: Apache Solr <= 7.1 XML entity injection
- POC CVE-2019-0193: Apache Solr Remote Code Execution
- POC CVE-2021-27905: Apache Solr <= 8.8.1 SSRF