CVE-2017-12629 Remote code execution occurs in Apache Solr
CriticalCVSS 9.8
EPSS 92.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.solr/solr-core(Maven) | >= 7.0.0, < 7.1.0 | 7.1.0 |
| org.apache.solr/solr-core(Maven) | = 7.0.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 7.0.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | >= 6.0.0, < 6.6.2 | 6.6.2 |
| org.apache.solr/solr-core(Maven) | = 6.0.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.0.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.1.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.2.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.2.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.3.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.4.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.4.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.4.2 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.5.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.5.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.6.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 6.6.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | >= 5.5.0, < 5.5.5 | 5.5.5 |
| org.apache.solr/solr-core(Maven) | = 5.5.0 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 5.5.1 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 5.5.2 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 5.5.3 | No fix listed |
| org.apache.solr/solr-core(Maven) | = 5.5.4 | No fix listed |
| debian/lucene-solr(Debian:12) | < 3.6.2+dfsg-11 | 3.6.2+dfsg-11 |
| debian/lucene-solr(Debian:13) | < 3.6.2+dfsg-11 | 3.6.2+dfsg-11 |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lucene-solr(Debian:14) | < 3.6.2+dfsg-11 | 3.6.2+dfsg-11 |
| apache solr | >= 5.5.0, <= 5.5.4 | No fix listed |
| apache solr | >= 6.0.0, <= 6.6.1 | No fix listed |
| apache solr | >= 7.0.0, <= 7.0.1 | No fix listed |
| redhat jboss enterprise application platform | = 7.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.1.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- 43009 exploit third-party-advisory vdb-entry
- DSA-4124 third-party-advisory vendor-advisory
- USN-4259-1 third-party-advisory vendor-advisory
- twitter.com third-party-advisory
- twitter.com third-party-advisory
- twitter.com third-party-advisory
- [lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE) exploit mailing-list vendor-advisory
- [debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security update mailing-list third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- issues.apache.org
- github.com product
- github.com vendor-advisory
- RHSA-2018:0005 third-party-advisory vendor-advisory
- RHSA-2018:0004 third-party-advisory vendor-advisory
- RHSA-2018:0003 third-party-advisory vendor-advisory
- RHSA-2018:0002 third-party-advisory vendor-advisory
- RHSA-2017:3452 third-party-advisory vendor-advisory
- RHSA-2017:3451 third-party-advisory vendor-advisory
- RHSA-2017:3244 third-party-advisory vendor-advisory
- RHSA-2017:3124 third-party-advisory vendor-advisory
- RHSA-2017:3123 third-party-advisory vendor-advisory
- [www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE) mailing-list vendor-advisory
- openwall.com mailing-list third-party-advisory
- 101261 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-12629 vendor-advisory
- [solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.java mailing-list
- [solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list