CVE-2017-7660
Apache Solr insecure inter-node communication
Also known as GHSA-c82r-qg3w-q5mv
Published 9 y ago · modified 4 mo ago · JSON
Summary
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
Exploit prediction (EPSS)
5.63% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.solr:solr-core | >=5.3.0, <5.5.5 >=6.0.0, <6.6.0 | 5.5.5 6.6.0 |
Affected products
- Apache Software Foundation Apache Solr
Classification
- Weakness
- CWE-287 Improper Authentication
References
- security.netapp.com /advisory/ntap-20181127-0003/ · x_refsource_CONFIRM, x_transferred
- mail-archives.us.apache.org /mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme- · mailing-list, x_refsource_MLIST, x_transferred
- securityfocus.com /bid/99485 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7660 · advisory
- issues.apache.org /jira/browse/SOLR-10624 · web
- lists.apache.org /thread/o0g7vpz5sz4yy0pyf1z94vkpv40x6h44 · web
- security.netapp.com /advisory/ntap-20181127-0003 · web
Sources
- CVE List: CVE-2017-7660
- GitHub Advisory: GHSA-c82r-qg3w-q5mv
- NVD: CVE-2017-7660
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.