Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Company
Platform
Modern NDR
Resources
Company
DETECTION OVERVIEW
Risk Factors
This vulnerability is well known, and public exploit code is available. An unauthenticated attacker can conduct malicious activity such as establishing command-and-control communication, installing malware, or performing reconnaissance through a reverse shell on a compromised device.
Category
Apache Solr is a Java-based search platform for enterprise software. Solr supports DataImportHandler (DIH), an optional plugin for uploading structured data from databases and other sources. DIH enables administrators to remotely change the entire DIH configuration through an HTTP request with a dataConfig parameter. Because the parameter string can include malicious scripts or code, DIH is vulnerable to remote code execution (RCE). An attacker sends an HTTP request with a malicious dataConfig parameter string in the URI or a payload in the HTTP request body. The malicious code or script runs on the Apache server. For example, an attacker can incorporate shellcode into the parameter string to create a reverse shell and run commands on the victim.
Upgrade to Solr 8.2.0 or later
If unable to upgrade, edit solrconfig.xml to include an empty string in the dataConfig parameter "invariants" list section for all DataImportHandler usages
Restrict access to Apache Solr DIH request handler to authorized users only
Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.
ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response
Visit this resource for more information.
This analysis exposes the critical link between an organization's lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.
Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.
Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.
