ColdFusion 9 Solr Vulnerability - Are you at Risk?
Adobe just released a security bulletin APSB10-04 for ColdFusion 9. If you have the Solr Search Service running on a ColdFusion 9 server it binds the Solr Web Service to port
8983 on all IP addresses. Adobe has also released a Technote describing how to fix the issue.
Is your CF9 Server at Risk?
I've updated my ColdFusion Security Scanner: hackmycf.com to test for this issue. So you can just head over there and type in your domain / email to find out.
Adobe has classified this issue as Important not Critical, but if you are using the CF9 solr service to index sensitive data, it could very well be a critical issue for you to resolve. Also if any vulnerabilities are discovered in the Solr web service itself it may become critical. I am sure a denial of service attack would be pretty easy to perform given the tools the Solr Service exposes.
It also exposes a lot of system information, all the java system properties can be exposed by visiting: http://localhost:8983/solr/data_medialibrary/admin/get-properties.jsp, which exposes things such as:
- Operating System
- Operating System Patch Level
- ColdFusion Installation Paths
- Java Version Info
The good news is that if you have a network firewall in place, your firewall should be blocking requests for this port.
Given all you can do with this service, I would strongly recommend you do the following:
- Make sure your firewall blocks port 8983
- Disable the Solr Search Service if you are not using it.
- Follow the instructions in the technote to limit access to localhost.
- New HackMyCF Features - October 24, 2013
- J2EE Sessions in CF10 Uses Secure Cookies - April 5, 2013
- Learn about ColdFusion Security at cfObjective 2013 - March 6, 2013
- Session Loss and Session Fixation in ColdFusion - March 1, 2013
- Understanding HashDos and postParameterLimit - August 1, 2012
- Apache Security Patches on CentOS / RHEL
- FuseGuard 2.4 Released
- New HackMyCF Features
- Blocking .svn and .git Directories on Apache or IIS
- CFDocs site now Open Source
- Getting Size of Heap and Non Heap Memory in CFML
- Firefox Aurora now Supports Content Security Policy 1.0
- Writing Secure CFML cfObjective 2013 Slides