Advisory details:
gitlab / maven/org.apache.solr/solr-core/CVE-2019-17558
| Advisory ID | gitlab/maven/org.apache.solr/solr-core/CVE-2019-17558 |
| Aliases |
CVE-2019-17558
GHSA-ww97-9w65-2crx |
| Summary | Improper Input Validation in Apache Solr Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user). |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| Data source | KEV |
|---|---|
| Date added | Nov. 3, 2021 |
| Description | The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. |
| Required action | Apply updates per vendor instructions. |
| Due date | May 3, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2019-17558 |
| Ransomware campaign use | Unknown |
| Data source | Exploit-DB |
|---|---|
| Date added | Nov. 1, 2019 |
| Description | Apache Solr 8.2.0 - Remote Code Execution |
| Ransomware campaign use | Unknown |
| Source publication date | Nov. 1, 2019 |
| Exploit type | webapps |
| Platform | java |
| Source update date | April 16, 2020 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a vulnerability in Apache Solr <= 8.3.0 which allows remote code execution via a custom Velocity template. Currently, this module only supports Solr basic authentication. From the Tenable advisory: An attacker could target a vulnerable Apache Solr instance by first identifying a list of Solr core names. Once the core names have been identified, an attacker can send a specially crafted HTTP POST request to the Config API to toggle the params resource loader value for the Velocity Response Writer in the solrconfig.xml file to true. Enabling this parameter would allow an attacker to use the Velocity template parameter in a specially crafted Solr request, leading to RCE. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk - config-changes - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 29, 2019 |
| Platform | Java,Linux,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/solr_velocity_rce.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:05:04Z/
Decision: Attend
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2019/17xxx/CVE-2019-17558.json
Source Advisory: vulnrichment/CVE-2019-17558
[{'Exploitation': 'active'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]