Actively exploited · Published Dec 30, 2019 · Assigned by apache

CVE-2019-17558

High 7.5 Exploited

In plain English

A high-severity injection in Apache Solr. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 98.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)98.6%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	lucene-solr	no fix listed	DEBIAN-CVE-2019-17558
Debian:13	lucene-solr	no fix listed	DEBIAN-CVE-2019-17558
Debian:14	lucene-solr	no fix listed	DEBIAN-CVE-2019-17558
Maven	org.apache.solr:solr-core	8.4.0	GHSA-ww97-9w65-2crx
Maven	org.apache.solr:solr-core	8.4.0	GHSA-ww97-9w65-2crx
Maven	org.apache.solr:solr-core	8.4.0	GHSA-ww97-9w65-2crx
Maven	org.apache.solr:solr-core	8.4.0	GHSA-ww97-9w65-2crx

Affected products (as reported)

Vendor	Product	Versions
n/a	Apache Solr	Apache Solr 5.0.0 to Apache Solr 8.3.1

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

[lucene-issues] 20200107 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat opened a new pull request #1156: SOLR-13971 mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [GitHub] [lucene-solr] artem-smotrakov commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat closed pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200113 [jira] [Commented] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list, x_refsource_MLIST
[lucene-issues] 20200113 [GitHub] [lucene-solr] chatman commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-dev] 20200213 Re: 7.7.3 bugfix release mailing-list, x_refsource_MLIST
[lucene-dev] 20200214 Re: 7.7.3 bugfix release mailing-list, x_refsource_MLIST
[lucene-issues] 20200219 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list, x_refsource_MLIST
[ambari-issues] 20200220 [jira] [Created] (AMBARI-25482) solr dependence CVE-2019-17558 mailing-list, x_refsource_MLIST
[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list, x_refsource_MLIST
[lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
https://issues.apache.org/jira/browse/SOLR-13971 x_refsource_MISC
http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html x_refsource_MISC
[submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended mailing-list, x_refsource_MLIST
[lucene-solr-user] 20210203 Re: SolrCloud keeps crashing mailing-list, x_refsource_MLIST
[lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham edited a comment on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[lucene-solr-user] 20210212 CVE-2019-17558 on SOLR 6.1 mailing-list, x_refsource_MLIST
[lucene-solr-user] 20210212 Re: CVE-2019-17558 on SOLR 6.1 mailing-list, x_refsource_MLIST
[lucene-solr-user] 20210213 Re: CVE-2019-17558 on SOLR 6.1 mailing-list, x_refsource_MLIST
[lucene-issues] 20210315 [GitHub] [lucene-solr] erikhatcher commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list, x_refsource_MLIST
[druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves mailing-list, x_refsource_MLIST
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17558 government-resource