CVE-2019-17558

Deeper analysis

Apache Solr versions 5.0.0 through 8.3.1 contain a remote code execution vulnerability in the VelocityResponseWriter component. The issue stems from the ability to supply Velocity templates either via a user-controlled configset in the velocity/ directory or through request parameters when the params.resource.loader.enabled setting is activated on a custom response writer. Because these templates are rendered without sufficient sandboxing, an attacker-supplied template can execute arbitrary code on the Solr server. The CVSS 7.5 score reflects the high impact on confidentiality, integrity, and availability when the flaw is successfully triggered.

Exploitation requires an attacker to either upload a malicious configset or obtain access to the Solr configuration API in order to define a response writer with the parameter resource loader enabled. Once a template containing executable directives is rendered, the attacker can achieve full remote code execution under the privileges of the Solr process. The attack complexity is rated high because parameter-based templates are disabled by default and configset uploads typically require authentication.

Advisories and the Solr 8.4 release notes state that the params resource loader has been removed entirely. Configset-provided Velocity templates are now rendered only when the configset is marked trusted, which occurs solely for uploads performed by authenticated users. Security practitioners are advised to upgrade to Solr 8.4 or later and to restrict configuration API access to trusted administrators.