Michael Stepankin - Apache Solr Injection
Discovers Solr injection, a new web attack class targeting Apache Solr search parameters to achieve SSRF and remote code execution.
Summary
Apache Solr Injection Attacks
Michael Stepankin presents Solr Injection, a new class of web application vulnerability analogous to SQL injection but targeting Apache Solr search infrastructure.
Solr Attack Surface
Apache Solr powers search functionality in many enterprise applications. When user input is incorporated directly into Solr query parameters, attackers can inject additional parameters that modify query behavior, similar to second-order SQL injection.
SSRF via RequestDispatcher
Solr's RequestDispatcher parameter (shards) accepts URLs for distributed search across Solr shards. By injecting a shards parameter, attackers redirect Solr to make arbitrary HTTP requests to internal services — a server-side request forgery vector that bypasses application-level SSRF mitigations.
RCE via Velocity Template Injection
Solr's velocity response writer interprets Velocity template syntax in query parameters. Injecting Velocity template expressions achieves server-side template injection leading to arbitrary Java code execution on the Solr server, as demonstrated against real enterprise deployments.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·48 min
David Leadbeater
David Leadbeater revisits 60 years of terminal escape sequence vulnerabilities, detailing multiple remote code execution flaws across major terminal emulators.
Main Stage·20 min
Mikhail Shcherbakov · Musard Balliu
Mikhail Shcherbakov and Musard Balliu uncover universal Prototype Pollution gadgets within Node.js core and popular NPM packages, achieving RCE across major applications.