Description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Solr before 7.1 with Apache Lucene before 7.1 | Apache Solr before 7.1 with Apache Lucene before 7.1, lucene-solr – < 7.1.0, lucene-solr – < 5.3.1-redhat-2 | lucene-solr 7.2.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 13 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 12 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 9 | lucene-solr | 3.6.2+dfsg-10+deb9u1 | DSA-4124-1 |
| Debian 8 | lucene-solr | 3.6.2+dfsg-5+deb8u1 | DSA-4124-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | lucene-solr | 3.6.0+dfsg-1+deb7u3 | DLA-1254-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | lucene-solr | 3.6.2+dfsg-8ubuntu0.1 | USN-4259-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | lucene-solr | 3.6.2+dfsg-2ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-java-common-lucene +20 | 4.8.0-6.9.el6 | RHSA-2017:3451 |
| RHEL 3 | rh-java-common-lucene5 +19 | 5.4.1-2.4.el6 | RHSA-2017:3452 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +14 | 1.1.0-19.SP24_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.0.16-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.3.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.9-2.GA_redhat_2.ep7.el6 | RHSA-2018:0005 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.25-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.4.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.12-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-lucene-core +7 | 5.3.1-4.redhat_2.1.ep7.el6 | RHSA-2017:3123 |
| Red Hat JBoss EAP 7 | eap7-resteasy +17 | 3.0.19-7.SP5_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.3.31-3.Final_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.9-4.GA_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.9-2.GA_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution EDB-43009 · webapps · Oct 17, 2017 · verified
GitHub 2 repositories
-
CyberCTF/vulhub-solr-cve-2017-12629-rce ★ 0 · Oct 8, 2026
Vulhub solr/CVE-2017-12629-RCE: Apache Solr RunExecutableListener RCE (CVE-2017-12629), run with Isoloom
-
captain-woof/cve-2017-12629 ★ 0 · Aug 1, 2025
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener …
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Solr <= 7.1 - XML Entity Injection http/cves/2017/CVE-2017-12629.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-core | >= 7.0.0, < 7.1.0 | 7.1.0 | GHSA-mh7g-99w9-xpjm |
| Maven | org.apache.solr:solr-core | >= 6.0.0, < 6.6.2 | 6.6.2 | GHSA-mh7g-99w9-xpjm |
| Maven | org.apache.solr:solr-core | >= 5.5.0, < 5.5.5 | 5.5.5 | GHSA-mh7g-99w9-xpjm |
Advisories 9
- RHSA-2018:0005 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0004 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0002 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3452 Red Hat Security Advisory: rh-java-common-lucene5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3451 Red Hat Security Advisory: rh-java-common-lucene security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3123 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4124-1 lucene-solr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1254-1 lucene-solr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4259-1 Apache Solr vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- RHSA-2017:3451 vendor-advisory
- [lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE) mailing-list
- RHSA-2018:0002 vendor-advisory
- 101261 vdb-entry
- RHSA-2018:0004 vendor-advisory
- RHSA-2017:3452 vendor-advisory
- [debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security update mailing-list
- 43009 exploit
- RHSA-2018:0003 vendor-advisory
- RHSA-2017:3123 vendor-advisory
- RHSA-2018:0005 vendor-advisory
- RHSA-2017:3244 vendor-advisory
- RHSA-2017:3124 vendor-advisory
- [www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE) mailing-list
- DSA-4124 vendor-advisory
- USN-4259-1 vendor-advisory
- https://twitter.com/ApacheSolr/status/918731485611401216
- https://twitter.com/searchtools_avi/status/918904813613543424
- http://openwall.com/lists/oss-security/2017/10/13/1
- https://twitter.com/joshbressers/status/919258716297420802
- [solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.java mailing-list