CVE-2019-0193
HIGH KEV NUCLEIApache Solr < 7.7.3 and 8.0.0-8.1.1 - Remote Code Execution via DataImportHandler dataConfig Parameter
Title source: llmExploitation Summary
CVE-2019-0193 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 10, 2021. EIP tracks 5 public exploits from researchers including jas502n, 1135, xConsoIe. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python-based exploit for CVE-2019-0193, a remote code execution vulnerability in Apache Solr's DataImport Handler. The exploit automates the discovery of Solr cores and injects a malicious script via the URLDataSource configuration to achieve RCE.
Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Exploits (5)
This repository contains a Python-based exploit for CVE-2019-0193, a remote code execution vulnerability in Apache Solr's DataImport Handler. The exploit automates the discovery of Solr cores and injects a malicious script via the URLDataSource configuration to achieve RCE.
This repository provides a proof-of-concept exploit for CVE-2019-0193, an Apache Solr remote code execution vulnerability. It includes two exploit methods: one using URLDataSource (requires outbound network access) and another using ContentStreamDataSource (no outbound access required). Both methods leverage Solr's DataImportHandler to execute arbitrary commands via crafted XML configurations.
This PoC exploits CVE-2019-0193, a remote code execution vulnerability in Oracle WebLogic Server. It manipulates the work directory path to upload a JSP webshell, leveraging improper input validation in the administrative console.
This repository contains a proof-of-concept exploit for CVE-2019-0193, targeting Apache Solr's DataImportHandler. The exploit leverages a script transformer to execute arbitrary commands, resulting in a reverse shell to a specified IP and port.
This repository contains a functional exploit for CVE-2019-0193, targeting Apache Solr RCE via DataImportHandler misconfiguration. It automates the process of enabling remote streaming, executing arbitrary code, and writing a webshell.
Nuclei Templates (1)
cpe:"cpe:2.3:a:apache:solr" || http.title:"apache solr" || http.title:"solr admin"
title="solr admin" || title="apache solr"
References (23)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H