Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2019-17558GHSA-WW97-9W65-2CRX

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.

Published
Last modified
published
Listed in CISA KEV
Fix
Fixed in 8.4.0
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Solr, an open-source enterprise search platform, is affected in versions from 5.0.0 through 8.3.1, where its VelocityResponseWriter can be abused to run arbitrary code on the server. An attacker who can supply or modify malicious Velocity templates, such as through a user-defined configset or, when explicitly enabled, through request parameters, could gain remote code execution on the affected system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a Apache Solr

    Apache Solr 5.0.0 to Apache Solr 8.3.1

  • org.apache.solr:solr-coreMaven

    From 5.0.0 · fixed in 8.4.0

  • org.apache.solr:solr-coreMaven

    From 6.0.0 · fixed in 8.4.0

  • org.apache.solr:solr-coreMaven

    From 7.0.0 · fixed in 8.4.0

  • org.apache.solr:solr-coreMaven

    From 8.0.0 · fixed in 8.4.0

References 25

lists.apache.org

oracle.com

issues.apache.org

packetstormsecurity.com