CVE-2019-17558
Apache Solr flaw lets attackers run code through Velocity templates
Apache Solr versions 5.0.0 through 8.3.1 have a remote code execution flaw in VelocityResponseWriter, a component that renders Velocity templates; a configset is a set of Solr configuration files that can include such templates. An attacker who can supply a malicious template, through an untrusted configset or by enabling parameter-provided templates, can run code on the Solr server. CISA added the flaw to its known-exploited list on 2021-11-03, so attackers are using it, and the package records list Solr 8.4.0 as the fixed version.
n/a Apache Solr · Updated 3 Nov · From 1 of our story and the public records
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Upgrade Apache Solr to 8.4.0, the fixed version listed in the package records.
- If you cannot upgrade, keep parameter-provided Velocity templates disabled; they are off by default and are enabled only by setting params.resource.loader.enabled to true.
- Limit configuration API access, because defining a response writer with parameter templates enabled requires that access.
- CISA lists this flaw as known exploited, so prioritize internet-facing Solr servers for patching.
What happened
- 3 NovCISA added the Apache Solr flaw to its known-exploited list, meaning attackers are using it.
- 3 MayUS federal agencies had to fix the flaw by this deadline under CISA's order.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2019-17558 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | high 7.5 | 3 Nov | 99% |