[CKAN-Security] Solr Manipulation

[Adrià Mercader]

Hi Gil,

Thanks for your report. The technical team will discuss the issue and come
back to you as soon as possible.

Cheers,

Adrià

On 14 August 2017 at 10:40, Gil Hilário <gil at civity.nl> wrote:

> Hi,
>
> I recently reported a security flaw over public issue, this time I’m doing
> it through the right channel.
>
> We identified an issue that allows you to manipulate the Solr through a
> linked dataset.
>
> If you create a new dataset and you add a resource. If you give it the
> following URL, for example, http://localhost:8983/solr/
> ckan-schema-2.3/update?commit=true&stream.body=<delete><
> query>*:*</query></delete> it will simply remove all the datasets from
> the solr, and you will need to run the reindexer.
> The same way you can delete and manipulate all datasets because you have
> full access to Solr. The data itself is never touched but we though this
> was worth sharing with you because the possibilities of changing the
> perception of what’s available on the CKAN instance are limiteless.
>
>
> Best Regards,
>
> Gil Hilário
>
>
>
>
>
>
>
>
>
>
>
> [image: logo civity new]
>
>
>
> *T* +31 (0)6 24 16 07 23 | *E* gil at civity.nl
> Handelsweg 6-1 | 3707 NH Zeist
> *W* www.civity.nl
>
>
>
>
>
>
>
>
>
>
>
>
>
> *Civity is onderdeel van de Onetrail groep (www.onetrail.com
> <http://www.onetrail.com/>)*
>
> *Civity is initiatiefnemer van FIWARE LAB Nederland, de open innovatie
> omgeving voor smart cities **www.fiware-lab.nl*
> <http://www.fiware-lab.nl/>
>
> [image: cid:image005.png at 01D0D9C8.8D3B3A60]
> <https://www.linkedin.com/company/3284795?trk=tyah&trkInfo=clickedVertical%3Acompany%2CclickedEntityId%3A3284795%2Cidx%3A2-3-4%2CtarId%3A1473335093147%2Ctas%3Acivity>*[image:
> cid:image005.png at 01D20A7C.FC86C980]*
> <https://twitter.com/intent/follow?original_referer=https://about.twitter.com/resources/buttons&region=follow_link&screen_name=CivityNL&tw_p=followbutton>
>
>
>
>
>
> _______________________________________________
> CKAN security
> https://lists.okfn.org/mailman/listinfo/security
> https://lists.okfn.org/mailman/options/security/adria.mercader%40okfn.org
>
> Repo: https://github.com/ckan/ckan-security
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.okfn.org/mailman/private/security/attachments/20170814/d4051378/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 3186 bytes
Desc: not available
URL: <https://lists.okfn.org/mailman/private/security/attachments/20170814/d4051378/attachment-0001.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 1578 bytes
Desc: not available
URL: <https://lists.okfn.org/mailman/private/security/attachments/20170814/d4051378/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 1828 bytes
Desc: not available
URL: <https://lists.okfn.org/mailman/private/security/attachments/20170814/d4051378/attachment-0003.png>