Apache Solr remained vulnerable to a zero-day weeks after proof-of-concept code became public for CVE-2019-17558.UPDATE 12/31/2019: The background and solution sections below have been updated to reflect the recent security update released by Apache.

CVE-2019-17558: Apache Solr Vulnerable to Remote Code Execution Zero-Day Vulnerability

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the     VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset     `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially     malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting     `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a     response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely,     and only enables the configset-provided template rendering when the configset is `trusted` (has been     uploaded by an authenticated user). (CVE-2019-17558)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the
    VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset
    `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially
    malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting
    `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a
    response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely,
    and only enables the configset-provided template rendering when the configset is `trusted` (has been
    uploaded by an authenticated user). (CVE-2019-17558)

The 16.1-16.2, 17.7-17.12, 18.8, and 19.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Derby)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Primavera Unifier accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2015-1832)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (iText)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in takeover of Primavera Unifier. (CVE-2017-9096)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Solr)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Difficult     to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier.
    (CVE-2019-17558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Community reports :

8.1.1 and 8.2.0 users check ENABLE_REMOTE_JMX_OPTS setting

Apache Solr RCE vulnerability due to bad config default

Apache Solr RCE through VelocityResponseWriter

Apache Solr Versions 5.0.0 to 8.3.1 are vulnerable to a Remote Code Execution vulnerability via the VelocityResponseWriter method. A template may be provided in a configset '/velocity' directory or as a request paramter. A user defined configset may contain potentially malicious templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Solr versions 5.0.0 to 8.3.1 allow for a a remote, unauthenticated user to set 'params.resource.loader.enabled' to true via an HTTP POST request to the JMX server. Enabling this parameter would allow an attacker to use the velocity template parameter in a specially crafted Solr request, leading to Remote Code Execution (RCE).

The version of Apache Solr running on the remote host is at least 5.0.0 and prior to 8.4.0. It is, therefore, affected by a remote code execution vulnerability. A remote code execution vulnerability exists in VelocityResponseWriter due to a flaw in the velocity template parameter. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with the privileges of Apache Solr.

The version of Apache Solr running on the remote web server is affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this issue, by sending a specially crafted HTTP POST request to the Config API to toggle the params resource loader value for the Velocity Response Writer in the solrconfig.xml file to true.
Enabling this parameter allows to use the velocity template parameter in a specially crafted Solr request to execute arbitrary code.

ID	Name	Product	Family	Severity
258878	Linux Distros Unpatched Vulnerability : CVE-2019-17558	Nessus	Misc.	high
423357	SCA: security update for org.apache.solr:solr-core (GHSA-ww97-9w65-2crx)	Tenable Cloud Security	SCA Checks	high
423357	SCA: security update for org.apache.solr:solr-core (GHSA-ww97-9w65-2crx)	Tenable Self-Hosted Container Security	SCA Checks	high
141641	Oracle Primavera Unifier (Oct 2020 CPU)	Nessus	CGI abuses	critical
134190	FreeBSD : Solr -- multiple vulnerabilities (e59cb761-5ad8-11ea-abb7-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
98931	Apache Solr 5.0.0 < 8.4.0 Remote Code Execution	Web App Scanning	Component Vulnerability	high
98924	Apache Solr < 8.4.0 Remote Code Execution	Web App Scanning	Component Vulnerability	high
132583	Apache Solr < 8.4.0 Remote Code Execution	Nessus	CGI abuses	high
131734	Apache Solr Config API Velocity Template RCE (Direct Check)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2019-17558

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high