Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2019-0193GHSA-3GM7-V7VW-866C

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi

Affects Apache Solr versions before 8.2.0 where the DataImportHandler module is in use. Fixed in 8.2.0, which is secure by default.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 8.2.0
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Solr's DataImportHandler module, which pulls data from databases and other sources, can accept a full configuration through a request parameter, and because those configurations can include scripts, this creates a security risk. The impact is that an attacker could potentially run malicious code on the affected Solr server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Apache Solr

    Apache Solr all prior to 8.2.0

  • org.apache.solr:solr-coreMaven

    fixed in 8.2.0

References 22

issues.apache.org

lists.debian.org

lists.apache.org

FAQ

Questions about CVE-2019-0193

What does this mean?

The DataImportHandler accepts a dataConfig parameter in a request. A DIH config can contain scripts, so the bug lets a request supply scripts that Solr runs, which gives remote code execution.Source: issues.apache.org

Am I affected, and how do I check?

Apache Solr versions before 8.2.0 are affected when the DataImportHandler module is in use. From 8.2.0 on, the dataConfig parameter also requires the Java system property enable.dih.dataConfigParam set to true. To check, look at the Solr version and whether DataImportHandler is configured in solrconfig.xml.Source: issues.apache.org

What should I do about it?

Upgrade to Solr 8.2.0 or later, which is secure by default. If an upgrade is not possible, configure all DataImportHandler usages in solrconfig.xml with an invariants section that sets the dataConfig parameter to an empty string.Source: issues.apache.org

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-12-10, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data