CVE-2020-13957

CRITICAL

Incorrect Authorization in Apache Solr

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-13957 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

4
ProductSourceVersion range

Apache Solr

CVE ListApache Solr 6.6.0 to 6.6.6, 7.0.0 to 7.7.3, 8.0.0 to 8.6.2affected

org.apache.solr:solr-core

Browse Maven / org.apache.solr:solr-core
GitHub Advisory6.6.0 to < 8.6.3 · Fixed in 8.6.3affected

org.apache.solr:solr-parent

Browse Maven / org.apache.solr:solr-parent
GitHub Advisory6.6.0 to < 8.6.3 · Fixed in 8.6.3affected

org.apache.solr:solr-solrj

Browse Maven / org.apache.solr:solr-solrj
GitHub Advisory6.6.0 to < 8.6.3 · Fixed in 8.6.3affected

Proofs of concept

1

Repository PoCs

GitHubs-index/CVE-2020-13957Repository PoCby s-index1Not analyzed3 files

78.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

s-index/CVE-2020-13957Created Vuln labCVE-2020-13957Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based proof-of-concept environment for Apache Solr RCE vulnerability CVE-2020-13957. It builds a Solr 8.2.0 image on OpenJDK 11 JRE and provides instructions to start Solr Cloud and execute a remote code execution exploit via Velocity template injection.

README.md:1Dockerfile:1-14

Lab assessment

Vulnerability lab

The README explicitly describes a CVE-2020-13957 proof-of-concept, provides exploit steps, and the Dockerfile builds a vulnerable Solr version (8.2.0) to demonstrate the vulnerability.

README.md:1README.md:5Dockerfile:5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds vulnerable Solr image

Defines a Docker image based on openjdk:11.0.9.1-jre-buster, installs lsof and procps, downloads and extracts Apache Solr 8.2.0, and sets the working directory to the Solr bin directory.

Dockerfile:1-14

myconfigset.zip

malicious Solr ConfigSet

A binary zip file referenced in the README exploit steps as the ConfigSet to upload. Its contents are uninspected, but it is used to trigger the vulnerability.

README.md:37

README.md

documentation and exploit guide

Provides setup and exploit instructions for the CVE-2020-13957 vulnerability, including Docker and Mac environments, and demonstrates remote code execution via curl commands.

README.md:1-119
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-13957

Supported by supplied evidence

The README explicitly targets CVE-2020-13957, describes the vulnerability, and provides a working exploit against Solr 8.2.0, which falls within the affected version range (8.0.0 to 8.6.2).

README.md:1README.md:5README.md:9-11
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:17
  • The myconfigset.zip file must be present in the build context.README.md:37
  • Solr Cloud must be started inside the container.README.md:27

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.README.md:19
  2. Run a container from the image with port 8983 exposed and start a bash shell.README.md:23
  3. Start Apache Solr Cloud inside the container.README.md:27
  4. Upload the malicious ConfigSet (myconfigset.zip) via the Solr API.README.md:37
  5. Create a new Solr collection using the uploaded ConfigSet.README.md:43
  6. Execute the 'id' command via Velocity template injection to achieve RCE.README.md:49
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own Solr instance inside the container. The exploit executes 'id' within the container, which is expected for a vulnerability demonstration. No evidence of host escape, external connections, persistence, or credential theft is present.

README.md:49README.md:53
Review boundaries

What the analysis did not establish

  • myconfigset.zip is a binary file and its contents are uninspected; it could contain additional unexpected payloads.
  • The Dockerfile does not copy myconfigset.zip into the image, so the exploit step requires the file to be present on the host and accessible to curl, which is not explicitly documented.
  • The README references a Mac demo that executes 'open -a calculator' on the host, but this is outside the Docker lab scope and not part of the containerized environment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 45