CVE-2019-0193

CVSS 7.2 HIGHEPSS 83.5%● KEVCWE-94

In short

Apache Solr's DataImportHandler allows loading configuration from user requests, which can contain dangerous scripts. This creates a security hole where attackers could execute arbitrary code on the server.

Technical detail

CVE-2019-0193 affects Apache Solr's DataImportHandler module, which accepts DIH configuration via the 'dataConfig' request parameter. Since DIH configs support script execution, an unauthenticated remote attacker can inject malicious scripts through this parameter to achieve arbitrary code execution. Mitigation requires Java system property 'enable.dih.dataConfigParam' set to true (disabled by default in 8.2.0+).

Summary generated and translated by AI from the official description.

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache · Apache Solr

public PoCs found — 5

githubgithub.com/jas502n/CVE-2019-0193★ 90 githubgithub.com/1135/solr_exploit★ 65 githubgithub.com/xConsoIe/CVE-2019-0193★ 7 githubgithub.com/jaychouzzk/CVE-2019-0193-exp★ 1 githubgithub.com/freeFV/ApacheSolrRCE★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References