CVE-2019-17558
HIGH KEV NUCLEIApache Solr 5.0.0-8.3.1 - Remote Code Execution via Velocity Template Injection
Title source: llmExploitation Summary
CVE-2019-17558 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 8 public exploits from researchers including Metasploit, @l3x_wong, zhzyker, including a Metasploit module exploits/multi/http/solr_velocity_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2019-17558 in Apache Solr <= 8.3.0 by enabling the Velocity Response Writer's params resource loader and executing arbitrary code via a custom Velocity template. It supports multiple platforms and payload types, including Unix, Linux, and Windows targets.
Description
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Exploits (8)
This Metasploit module exploits CVE-2019-17558 in Apache Solr <= 8.3.0 by enabling the Velocity Response Writer's params resource loader and executing arbitrary code via a custom Velocity template. It supports multiple platforms and payload types, including Unix, Linux, and Windows targets.
This exploit leverages a Velocity template injection vulnerability in Apache Solr 8.2.0 to achieve remote code execution (RCE) by manipulating the configuration to enable arbitrary command execution via a crafted HTTP request.
The repository contains a working proof-of-concept exploit for CVE-2018-7600, a remote code execution vulnerability in Drupal. The exploit leverages the Drupalgeddon 2 vulnerability to execute arbitrary commands on vulnerable Drupal installations.
This repository contains a functional Python exploit for CVE-2019-17558, a remote code execution vulnerability in Apache Solr. The exploit leverages the VelocityResponseWriter to execute arbitrary commands by manipulating Solr's configuration and template parameters.
The repository claims to be a tool for detecting and exploiting CVE-2019-17558 (Solr Velocity template injection RCE) but provides no actual exploit code. It only includes a README with generic descriptions and screenshots, directing users to download platform-specific JAR files from an external source.
This repository provides a detailed technical writeup of exploiting CVE-2019-17558, a Velocity Template Injection vulnerability in Apache Solr, including manual exploitation steps and analysis of why automated tools like Metasploit failed.
The repository contains a vague README with no actual exploit code, only a brief description mentioning URL encoding and HTTP requests. It lacks technical details about the vulnerability or functional PoC code.
This Metasploit module exploits CVE-2019-17558 in Apache Solr <= 8.3.0 by enabling the Velocity Response Writer's params resource loader and executing arbitrary code via a crafted Velocity template. It supports multiple targets (Java, Unix, Linux, Windows) and includes authentication handling.
Nuclei Templates (1)
cpe:"cpe:2.3:a:apache:solr" || http.title:"apache solr" || http.title:"solr admin"
title="solr admin" || title="apache solr"
References (30)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H