Coder Social home page Coder Social logo

apache-solr-rce's People

Contributors

imanfeng avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar

Forkers

c0010 yizhimanpadewoniu rockmelodies set619 lp008 lubyruffy sry309 5l1v3r1 doanhnhq ztz472947849 quinn-yan deepwebhacker cleanmgr112 fa1c0n1 hiiiif 0xfatty 303donatello caizhuang jasonlou muyuxx gysf666 0xf4vul defmax weiwhy lin962648 yyming-sudo superzero heyzm hackerxj007 tounsi007 agelovito caoeryeyoushang loveshell jeningogo whizsail not-know kuteminh11 brucefeiix dk47os3r jeromeyoung harry1080 n0ooooone rank0 qianniaoge sunpeak iptl-f4ck jxpsx 419066074 crackercat freefv shuai19980 akirboyun purewatersun zhuxi1965 lay0us1 exposir anonimo501

apache-solr-rce's Issues

CVE-2020-13957利用问题

CVE-2020-13957进一步利用时，除了可以利用CVE-2019-17558，是否可以利用其他的历史cve呢，参考信息如下：

Upload a ConfigSet, sent in as a zipped file. Please note that a ConfigSet is uploaded in a "trusted" mode if authentication is enabled and this upload operation is performed as an authenticated request. Without authentication, a ConfigSet is uploaded in an "untrusted" mode. Upon creation of a collection using an "untrusted" ConfigSet, the following functionality would not work:

  • RunExecutableListener does not initialize, if specified in the ConfigSet.
  • DataImportHandler 's ScriptTransformer does not initialize, if specified in the ConfigSet.
  • XSLT transformer (tr parameter) cannot be used at request processing time.
  • StatelessScriptUpdateProcessor does not initialize, if specified in the ConfigSet.

因为 RunExecutableListener ，DataImportHandler 都存在对应的RCE问题：
https://issues.apache.org/jira/browse/SOLR-13669
https://issues.apache.org/jira/browse/SOLR-11482

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.