Conversation
7.4 came ⇒ 7.3.1 disappeared everywhere!
copy-jars
XML External Entity attack
1. if HTTP API is exposed:
- read any file on the system — via /search/extract, the error message leaks
file content;
- send HTTP «GET /» request to any host — by PUT/POSTing text/xml document,
or via /search/extract. This is also likely riak DoS if the host is
attacker-controlled.
2. if PB API is exposed
- send HTTP «GET /» request to any host — by PUT/POST, see above.
Example request:
<?xml version="1.0"?>
<!DOCTYPE meow [
<!ENTITY xxe2 SYSTEM "/etc/passwd">
<!ENTITY xxe1 SYSTEM "http://host/ping-me">
]>
<meow>&xxe1;</meow>
It doesn't check user-provided path in any way. This allows overriding any file on the system with riak permissions.
Security fixes
1. if HTTP API is exposed:
- read any file on the system — via /search/extract, the error message leaks
file content;
- send HTTP «GET /» request to any host — by PUT/POSTing text/xml document,
or via /search/extract. This is also likely riak DoS if the host is
attacker-controlled.
2. if PB API is exposed:
- send HTTP «GET /» request to any host — by PUT/POST, see above.
3. if HTTP API is exposed:
- override (with garbage) any file on the system with riak permissions.
|
Plans for this at the moment. I want to do run the riak_test tests this weekend, I suspect many won't pass (as already highlighted) - but if we can justify why, that's OK, and we can see what sort of test coverage we're left with. I have an urgent need to cut riak 2.9.2 - so if there's anything I'm not sure about I'll hold off merging in until that release is completed. I intend to put out a release candidate with this in soon after - but I may try and juggle two streams for now. ASAP, I want to get this, and the backlog of 2.9 changes, into the 3.0 release. |
|
Running riak_test, the majority of yokozuna tests pass: Some test fail, but are tests of upgrades which we therefore wouldn't expect to pass: There are some other test failures though. These might be explained by simple changes (e.g. to the solr rest API), so potentially could be easily solvable: |
|
A bigger set of problems after merging into 3.0: |
|
The failure of |
|
The failure of |
|
The failure of |
|
deprecated by #766 |
3 participants
Pull request with yokozuna updated to solr7