Description
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Solr | Apache Solr 5.0.0 to Apache Solr 8.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lucene-solr | No fix yet | — |
| Debian 13 | lucene-solr | No fix yet | — |
| Debian 12 | lucene-solr | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Solr Remote Code Execution via Velocity Template
exploit/multi/http/solr_velocity_rce
Exploit-DB 2
- Apache Solr - Remote Code Execution via Velocity Template (Metasploit) EDB-48338 · remote · Apr 16, 2020 · verified
- Apache Solr 8.2.0 - Remote Code Execution EDB-47572 · webapps · Nov 1, 2019
GitHub 6 repositories
-
zhzyker/exphub ★ 4,298 · Apr 1, 2020
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-20…
-
Ma1Dong/Solr_CVE-2019-17558 ★ 2 · Aug 4, 2020
Solr_CVE-2019-17558
-
rogerzeferino/cve-2019-17558-apache-solr-rce ★ 1 · Feb 16, 2026
-
thelostworldFree/CVE-2019-17558_Solr_Vul_Tool ★ 1 · Mar 27, 2020
CVE-2019-17558 Solr模板注入漏洞图形化一键检测工具。CVE-2019-17558 Solr Velocity Template Vul POC Tool.
-
CyberCTF/vulhub-solr-cve-2019-17558 ★ 0 · Oct 8, 2026
Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with Isoloom
-
xkyrage/Exploit_CVE-2019-17558-RCE ★ 0 · Dec 15, 2020
Apache Solr 1.4 Injection to get a shell
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Solr <=8.3.1 - Remote Code Execution http/cves/2019/CVE-2019-17558.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-core | >= 5.0.0, < 8.4.0 | 8.4.0 | GHSA-ww97-9w65-2crx |
| Maven | org.apache.solr:solr-core | >= 6.0.0, < 8.4.0 | 8.4.0 | GHSA-ww97-9w65-2crx |
| Maven | org.apache.solr:solr-core | >= 7.0.0, < 8.4.0 | 8.4.0 | GHSA-ww97-9w65-2crx |
| Maven | org.apache.solr:solr-core | >= 8.0.0, < 8.4.0 | 8.4.0 | GHSA-ww97-9w65-2crx |
Advisories 1
- WID-SEC-2023-1048 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2024
References
- [lucene-issues] 20200107 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200108 [jira] [Commented] (SOLR-13971) CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200108 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list
- [lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat opened a new pull request #1156: SOLR-13971 mailing-list
- [lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200108 [GitHub] [lucene-solr] artem-smotrakov commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200108 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat closed pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200113 [jira] [Commented] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list
- [lucene-issues] 20200113 [GitHub] [lucene-solr] chatman commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20200113 [GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-dev] 20200213 Re: 7.7.3 bugfix release mailing-list
- [lucene-dev] 20200214 Re: 7.7.3 bugfix release mailing-list
- [lucene-issues] 20200219 [jira] [Updated] (SOLR-14025) CVE-2019-17558: Velocity response writer RCE vulnerability persists after 8.3.1 mailing-list
- [ambari-issues] 20200220 [jira] [Created] (AMBARI-25482) solr dependence CVE-2019-17558 mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- [lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://issues.apache.org/jira/browse/SOLR-13971
- http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html
- [submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended mailing-list
- [lucene-solr-user] 20210203 Re: SolrCloud keeps crashing mailing-list
- [lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham edited a comment on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-issues] 20210210 [GitHub] [lucene-solr] rhtham commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [lucene-solr-user] 20210212 CVE-2019-17558 on SOLR 6.1 mailing-list
- [lucene-solr-user] 20210212 Re: CVE-2019-17558 on SOLR 6.1 mailing-list
- [lucene-solr-user] 20210213 Re: CVE-2019-17558 on SOLR 6.1 mailing-list
- [lucene-issues] 20210315 [GitHub] [lucene-solr] erikhatcher commented on pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability mailing-list
- [druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves mailing-list