PT-2019-5683 · Apache+1 · Apache Solr+1

Published 2019-12-30 · Updated 2025-10-27 · CVE-2019-17558

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Solr versions 5.0.0 through 8.3.1

Description The issue is related to insufficient input validation in the VelocityResponseWriter component of Apache Solr, allowing for remote code execution. A Velocity template can be provided through the velocity/ directory in a configset or as a parameter. User-defined configsets may contain potentially malicious templates. Parameter-provided templates are disabled by default but can be enabled by setting params.resource.loader.enabled to true through a response writer definition, which requires configuration API access.

Recommendations For Apache Solr versions 5.0.0 through 8.3.1, consider disabling the VelocityResponseWriter until a patch is available or upgrade to Apache Solr 8.4, which removes the params resource loader and only enables configset-provided template rendering for trusted configsets. As a temporary workaround, restrict access to the configuration API to minimize the risk of exploitation. Avoid using parameter-provided templates in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

CWE-20

Related Identifiers

BDU:2020-05183

CVE-2019-17558

GHSA-WW97-9W65-2CRX

Affected Products

Apache Solr

Debian

References · 86

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solr_velocity_rce.rb · Exploit
• 🔥 https://github.com/zhzyker/exphub · Exploit
• 🔥❌ https://github.com/SDNDTeam/CVE-2019-17558_Solr_Vul_Tool · Exploit, Deleted
• 🔥 https://lists.apache.org/thread.html/r5074d814d3a8c75df4b20e66bfd268ee0a73ddea7e85070cec3ae78d%40%3Cissues.lucene.apache.org%3E · Exploit
• 🔥 https://issues.apache.org/jira/browse/SOLR-13971 · Exploit
• 🔥❌ https://github.com/kuckibf/Popular-CVEs · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/48338 · Exploit
• 🔥 http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html · Exploit
• 🔥 https://lists.apache.org/thread.html/rf6d7ffae2b940114324e036b6394beadf27696d051ae0c4a5edf07af%40%3Cissues.lucene.apache.org%3E · Exploit
• 🔥 https://exploit-db.com/exploits/47572 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-17558 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-17558 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17558 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17558 · Security Note