Linux servers using Apache Solr versions 8.1.1 and 8.2.0 with default configurations are potentially vulnerable to remote code execution. Background On July 22, 2019, a configuration flaw in versions 8.1.1 and 8.2.0 was found in Apache Solr, the open-source search-engine platform. John Ryan originally reported the issue and credit was also given to Matei “Mal” Badanoiu for noting the flaw could lead to remote code execution (RCE).

CVE-2019-12409: Default Configuration in Apache Solr Could Lead to Remote Code Execution

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS
    configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the
    default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on
    RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your
    firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn
    allow them to upload malicious code for execution on the Solr server. (CVE-2019-12409)

CVE-2019-12409 is a flaw in the default configuration of the solr.in.sh file in Apache Solr. If this file is used in its default configuration in versions 8.1.1 and 8.2.0, unauthenticated access to the Java Management Extensions (JMX) monitoring on the RMI_PORT (default 18983) is allowed. Anyone with access to a vulnerable Solr server, and, in turn, JMX, could upload malicious code that could then be executed.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Solr running on the remote web server is affected by a remote code execution vulnerability in the Config API due to unsafe deserialization of Java objects. An unauthenticated, remote attacker can exploit this, via a crafted serialized Java object, to execute arbitrary code.

The version of Apache Solr running on the remote web server is affected by a remote code vulnerability as referenced in the advisory.

ID	Name	Product	Family	Severity
423341	SCA: security update for org.apache.solr:solr-core (GHSA-2289-pqfq-6wx7)	Tenable Cloud Security	SCA Checks	critical
423341	SCA: security update for org.apache.solr:solr-core (GHSA-2289-pqfq-6wx7)	Tenable Self-Hosted Container Security	SCA Checks	critical
98929	Apache Solr 8.1.1 < 8.3.0 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
132315	Apache Solr 8.1.1, 8.2.0 Remote JMX RMI Deserialization Vulnerability	Nessus	CGI abuses	critical
131167	Apache Solr 8.1.1 / 8.2.0 Remote Code Execution Vulnerability	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-12409

critical

Tenable Plugins

critical

critical

critical

critical

critical