CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
Description
CVE-2019-17558 is a HIGH vulnerability affecting Apache Solr, carrying a CVSS 3.1 score of 7.5. The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. Affected products include Apache Solr (>= 5.0.0, < 7.7.3; >= 8.0.0, < 8.4.0), Oracle Primavera Unifier (>= 17.7, <= 17.12; 16.1; 16.2; 18.8; 19.12). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.94474 (100.00th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | solr | >= 5.0.0, < 7.7.3; >= 8.0.0, < 8.4.0 |
| oracle | primavera unifier | >= 17.7, <= 17.12; 16.1; 16.2; 18.8; 19.12 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://issues.apache.org/jira/browse/SOLR-13971(Exploit, Issue Tracking, Patch, Vendor Advisory)
- https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r12ab2cb15a34e49b4fecb5b2bdd7e10f3e8b7bf1f4f47fcde34d3a7c%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r19d23e8640236a3058b4d6c23e5cd663fde182255f5a9d63e0606a66%40%3Cdev.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r25f1bd4545617f5b86dde27b4c30fec73117af65598a30e20209739a%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r339865b276614661770c909be1dd7e862232e3ef0af98bfd85686b51%40%3Cdev.lucene.apache.org%3E(Issue Tracking, Mailing List)
- https://lists.apache.org/thread.html/r36e35fd76239a381643555966fb3e72139e018d52d76544fb42f96d8%40%3Cissues.lucene.apache.org%3E(Issue Tracking, Mailing List)
- https://lists.apache.org/thread.html/r5074d814d3a8c75df4b20e66bfd268ee0a73ddea7e85070cec3ae78d%40%3Cissues.lucene.apache.org%3E(Exploit, Mailing List)
- https://lists.apache.org/thread.html/r58c58fe51c87bc30ee13bb8b4c83587f023edb349018705208e65b37%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r5dc200f7337093285bac40e6d5de5ea66597c3da343a0f7553f1bb12%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r79c7e75f90e735fd32c4e3e97340625aab66c09dfe8c4dc0ab768b69%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r7b89b3dcfc1b6c52dd8d610b897ac98408245040c92b484fe97a51a2%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r7f21ab40a9b17b1a703db84ac56773fcabacd4cc1eb5c4700d17c071%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r8a36e4f92f4449dec517e560e1b55639f31b3aca26c37bbad45e31de%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r8e7a3c253a695a7667da0b0ec57f9bb0e31f039e62afbc00a1d96f7b%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r9271d030452170ba6160c022757e1b5af8a4c9ccf9e04164dec02e7f%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r99c3f7ec3a079e2abbd540ecdb55a0e2a0f349ca7084273a12e87aeb%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/ra29fa6ede5184385bf2c63e8ec054990a7d4622bba1d244bee70d82d%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rafc939fdd753f55707841cd5886fc7fcad4d8d8ba0c72429b3220a9a%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rc400db37710ee79378b6c52de3640493ff538c2beb41cefdbbdf2ab8%40%3Ccommits.submarine.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rde3dbd8e646dabf8bef1b097e9a13ee0ecbdb8441aaed6092726c98d%40%3Cissues.ambari.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/re8d12db916b5582a23ed144b9c5abd0bea0be1649231aa880f6cbfff%40%3Cissues.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rf6d7ffae2b940114324e036b6394beadf27696d051ae0c4a5edf07af%40%3Cissues.lucene.apache.org%3E(Exploit, Mailing List)
- https://www.oracle.com/security-alerts/cpuoct2020.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17558(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
CVE-2019-17558 is classified under CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Injection flaws occur when an application sends untrusted data to an interpreter as part of a command or query. By manipulating the input, an attacker can inject malicious content that the downstream component interprets as legitimate commands or data. This broad weakness category encompasses many specific injection types including SQL injection, command injection, LDAP injection, and template injection. The fundamental issue is insufficient separation between code and data, allowing attackers to alter the intended execution flow.
In the context of Apache Solr, this weakness is particularly dangerous because the VelocityResponseWriter processes user-controllable templates that can execute arbitrary code on the server. Template injection attacks exploit the trust relationship between the application and its template engine, bypassing traditional input validation. Organizations should recognize that template engines with code execution capabilities represent a significant attack surface when exposed to user input.
Learn more: CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
Impact Analysis
CVE-2019-17558 carries a CVSS 3.1 score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by Apache Solr, including configuration files, credentials, and potentially data from connected systems.
Integrity (HIGH): Attackers can modify critical system files, install backdoors, alter configurations, or deploy malware on affected systems running Apache Solr.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering the product inoperable.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is contained within the vulnerable component. The impact, while significant, is limited to the Apache Solr environment itself.
With an EPSS score of 0.94474 (100.00th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, underscoring the urgency of remediation.
Exploit Maturity
CVE-2019-17558 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.94474 (100.00th percentile) places it among the most exploited vulnerabilities tracked.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2019-17558. However, the confirmed exploitation in the wild means threat actors are actively using this vulnerability in attacks.
Attack surface: The vulnerability's high EPSS score and KEV listing confirm that threat actors have developed and used working exploits. Public proof-of-concept code and exploitation tools are available, making this vulnerability accessible to a wide range of attackers. Organizations should assume that automated scanning and exploitation tools targeting this vulnerability are in active use.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Upgrade Apache Solr to the latest patched version that addresses this vulnerability. Consult the official vendor advisory for specific patch guidance and release notes.
- Verify affected product versions in your environment. Identify all instances of Apache Solr in your infrastructure (affected versions: Apache Solr (>= 5.0.0, < 7.7.3; >= 8.0.0, < 8.4.0), Oracle Primavera Unifier (>= 17.7, <= 17.12; 16.1; 16.2; 18.8; 19.12)). Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply network-level controls such as restricting access to the affected component, enabling enhanced logging, and monitoring for indicators of compromise.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2019-17558.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2019-17558 is a HIGH-severity vulnerability in Apache Solr that can be exploited remotely over the network without physical access. The attack complexity is high, meaning specific conditions beyond the attacker's control must exist for exploitation to succeed. Low-level privileges are required, meaning the attacker needs some form of authenticated access. No user interaction is required, allowing fully automated exploitation.
Technical mechanism: Apache Solr 5.0.0 to 8.3.1 are vulnerable to Remote Code Execution through the VelocityResponseWriter. The underlying flaw relates to improper neutralization of special elements in output used by a downstream component (injection), which allows attackers to manipulate the application's processing logic in unintended ways. Successful exploitation enables arbitrary code execution on the target system, potentially leading to full system compromise.
CVSS 3.1 vector analysis: The vector reflects an Attack Vector of NETWORK, Attack Complexity of HIGH, Privileges Required of LOW, User Interaction of NONE, Scope UNCHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively. The Unchanged scope means impact is contained within the vulnerable component itself.
Frequently Asked Questions
Is CVE-2019-17558 being actively exploited?
Yes. CVE-2019-17558 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 0.94474 (100.00th percentile), it ranks among the most exploited vulnerabilities tracked globally. Organizations should treat this as an immediate remediation priority.
What products are affected by CVE-2019-17558?
The affected products include Apache Solr (>= 5.0.0, < 7.7.3; >= 8.0.0, < 8.4.0), Oracle Primavera Unifier (>= 17.7, <= 17.12; 16.1; 16.2; 18.8; 19.12). Organizations running any of these versions should verify their exposure and prioritize remediation. Check vendor advisories for the complete and most current list of affected versions.
How do I fix CVE-2019-17558?
Apply updates per vendor instructions. Ensure all affected instances of Apache Solr are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement network-level mitigations and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2019-17558?
CVE-2019-17558 is rated HIGH with a CVSS 3.1 score of 7.5. Its EPSS score of 0.94474 places it in the 100.00th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and was required to be remediated by federal agencies by 2022-05-03 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.