Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2017-7660 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 7.4 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | None |
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Portal Platform 6 | solr-core | Not affected |
| Red Hat JBoss Fuse Service Works 6 | solr-core | Will not fix |
| Red Hat JBoss Fuse 6 | camel | Not affected |
| Red Hat JBoss EAP 6 | solr-core | Not affected |
| Red Hat JBoss Data Virtualization 6 | solr-core | Not affected |
| Red Hat JBoss Data Grid 6 | solr-core | Not affected |
Vulmon