Date: Mon, 30 Dec 2019 08:11:44 -0500 From: Erik Hatcher <erik.hatcher@...il.com> To: oss-security@...ts.openwall.com Subject: [CVE-2019-17558] Apache Solr RCE through VelocityResponseWriter [CVE-2019-17558] Apache Solr RCE through VelocityResponseWriter Severity: High Vendor: The Apache Software Foundation Versions Affected: 5.0.0 to 8.3.1 Description: The affected versions are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity (.vm) templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user). Mitigation: Ensure your network settings are configured so that only trusted traffic communicates with Solr, especially to the configuration APIs. Credits: Github user `s00py` References: * https://cwiki.apache.org/confluence/display/solr/SolrSecurity * https://issues.apache.org/jira/browse/SOLR-13971 * https://issues.apache.org/jira/browse/SOLR-14025
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.