漏洞描述
Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193↗paper.seebug.orghttps://paper.seebug.org/1009/↗issues.apache.orghttps://issues.apache.org/jira/browse/SOLR-13669↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2019-0193↗lists.apache.orghttps://lists.apache.org/thread.html/1addbb49a1fc0947fb32ca663d76d93cfaade35a4848a76d4b4ded9c@%3Cissues.lucene.apache.org%3E↗