Hortonworks Data Platform for IBM Security Advisory: Critical Solr Vulnerability (CVE-2017-12629)

Content

COMPONENT : Ambari Infra Solr (Ambari 2.4.x, Ambari 2.5.x), HDP Search (All Versions)
 
VERSION: Solr 5.5.x included in all versions of Ambari Infra, and HDP Search
 
REFERENCE: CVE-2017-12629
 
PROBLEM : An XML External Entity and Remote Code Execution vulnerability has been identified in Solr
 
IMPACT:  The CoreParser class in Lucene accepts doctype declaration and expands external entities. An attacker could use this flaw to bypass security restrictions and access sensitive data. Additionally, a vulnerable server which also used the RunExecutableListener class in Solr's Config API could allow for the construction of a malicious object that could then be used to gain direct access to the server and execute arbitrary code.
 
SOLUTION:  Until fixes are available, all Solr users are advised to restart their Solr instances with the system parameter `-Ddisable.configEdit=true`. This will disallow any changes otherwise made to configurations via the Config API. This is a key factor in this vulnerability since it allows GET requests to add the RunExecutableListener to the config. This workaround is sufficient to protect from this type of attack but means you cannot use the edit capabilities of the Config API until further fixes are in place.  Additionally, the XML Query Parser should be mapped to a different class to ensure that it cannot be accessed through other attack vectors.
 
Disabling the Config Edit API
Ambari Infra Solr

1. Navigate to the Ambari Web UI and select the Ambari Infra service.
2. Expand the Advanced infra-solr-env configuration section.
3. Locate the infra-solr-env template property and scroll to the area of the template where the SOLR_OPTS variable is configured.
4. Add the following line after the last commented line referencing SOLR_OPTS:

1. Save this version of the configuration and restart the Infra Solr Instance

1. Navigate to the Ambari Web UI and select the Solr service.
2. Expand the Advanced solr-config-env configuration section.
3. Locate the solr.in.sh template property and scroll to the area of the template where the SOLR_OPTS variable is configured.
4. Add the following line after the last commented line referencing SOLR_OPTS:

1. Save this version of the configuration and restart the Solr

1. Navigate to the Ambari Web UI and select the Ranger service.
2. Expand the Advanced ranger-solr-configuration configuration section.
3. Locate the solr-config template property and scroll to the area of the template where the <queryParser/> XML tags are referenced.
4. Add the following line in an uncommented area of this template.  An uncommented area is in an area that is not surrounded by <!-- and --> tags:

1. Save this version of the configuration and restart the Ranger Admin

1. Navigate to the Ambari Web UI and select the Atlas service.
2. Expand the Advanced atlas-solrconfig configuration section.
3. Scroll to the area of the template where the <queryParser/> XML tags are referenced.
4. Add the following line in an uncommented area of this template.  An uncommented area is in an area that is not surrounded by <!-- and --> tags:

1. Save this version of the configuration and restart the Atlas Metadata Server

1. Navigate to the Ambari Web UI and select the Log Search service.
2. Expand the Advanced logsearch-audit_logs-solrconfig configuration section.
3. Locate the Solrconfig template property and scroll to the area of the template where the <queryParser/> XML tags are referenced.
4. Scroll to the area of the template where the <queryParser/> XML tags are referenced.
5. Add the following line in an uncommented area of this template.  An uncommented area is in an area that is not surrounded by <!-- and --> tags:

1. Expand the Advanced logsearch-service_logs-solrconfig configuration section.
2. Locate the solrconfig template property and scroll to the area of the template where the <queryParser/> XML tags are referenced.
3. Scroll to the area of the template where the <queryParser/> XML tags are referenced.
4. Add the following line in an uncommented area of this template.  An uncommented area is in an area that is not surrounded by <!-- and --> tags:

1. Save this version of the configuration and restart the Log Search Server