CVE-2019-0193highunder attackCWE-94

CVE-2019-0193

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.2epss 84%

from disclosure to weapon0 days

Published on NVDAug 1

1st PoCMar 18

CISA KEV+862d

exploitation probability

84%top 1% of all CVEs

observed exploitation

yesCISA + VulnCheck

10 public exploit(s)

Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

Versions

Affected

maven/org.apache.solr:solr-core < 8.2.0

Fixed in

maven/org.apache.solr:solr-core 8.2.0

Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache · Apache Solr

public PoCs found — 10

githubgithub.com/jas502n/CVE-2019-0193★ 90 githubgithub.com/1135/solr_exploit★ 65 githubgithub.com/xConsoIe/CVE-2019-0193★ 7 githubgithub.com/jaychouzzk/CVE-2019-0193-exp★ 1 githubgithub.com/freeFV/ApacheSolrRCE★ 0 vulncheckvulncheck.com/xdb/ccec007287baunverified vulncheckvulncheck.com/xdb/0ff186cb197funverified vulncheckvulncheck.com/xdb/c6f3730bd8f0unverified vulncheckvulncheck.com/xdb/f9730ca2bcd0unverified vulncheckvulncheck.com/xdb/9ca69682db00unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References