Apache Solr up to 8.3.1 velocity/ injection

Summaryinfo

A vulnerability labeled as critical has been found in Apache Solr up to 8.3.1. Affected by this vulnerability is an unknown functionality of the file velocity/. The manipulation results in input validation. This vulnerability is identified as CVE-2019-17558. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Apache Solr up to 8.3.1. Affected is an unknown part of the file velocity/. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

The weakness was released 12/30/2019. This vulnerability is traded as CVE-2019-17558 since 10/14/2019. It is possible to launch the attack remotely. A authentication is necessary for exploitation. Technical details and a public exploit are known. This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as attacked. As 0-day the estimated underground price was around $5k-$25k. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47572). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Apache

Name

• Solr

Version

• 8.3.0
• 8.3.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion