Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 30 Dec 2019 08:11:44 -0500
From: Erik Hatcher <>
Subject: [CVE-2019-17558] Apache Solr RCE through VelocityResponseWriter

[CVE-2019-17558] Apache Solr RCE through VelocityResponseWriter

Severity: High

Vendor: The Apache Software Foundation

Versions Affected: 5.0.0 to 8.3.1


The affected versions are vulnerable to a Remote Code Execution through the
VelocityResponseWriter.  A Velocity template can be provided through
Velocity (.vm) templates in a configset `velocity/` directory or as a
parameter.  A user defined configset could contain renderable, potentially
malicious, templates. Parameter provided templates are disabled by default,
but can be enabled by setting `params.resource.loader.enabled` by defining
a response writer with that setting set to `true`.  Defining a response
writer requires configuration API access.

Solr 8.4 removed the params resource loader entirely, and only enables the
configset-provided template rendering when the configset is `trusted` (has
been uploaded by an authenticated user).

Mitigation: Ensure your network settings are configured so that only
trusted traffic

communicates with Solr, especially to the configuration APIs.

Credits: Github user `s00py`





Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.