{"uuid": "f642871f-e008-4ed9-b4d1-f7b3385238a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-17558", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solr_velocity_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd, x86, x64\", \"author\": [\"s00py\", \"jas502n\", \"AleWong\", \"Imran E. Dawoodjee \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in Apache Solr <= 8.3.0 which allows remote code execution via a custom\\n          Velocity template. Currently, this module only supports Solr basic authentication.\\n\\n          From the Tenable advisory:\\n          An attacker could target a vulnerable Apache Solr instance by first identifying a list\\n          of Solr core names. Once the core names have been identified, an attacker can send a specially crafted\\n          HTTP POST request to the Config API to toggle the params resource loader value for the Velocity Response\\n          Writer in the solrconfig.xml file to true. Enabling this parameter would allow an attacker to use the Velocity\\n          template parameter in a specially crafted Solr request, leading to RCE.\", \"disclosure_date\": \"2019-10-29\", \"fullname\": \"exploit/multi/http/solr_velocity_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"Apache Solr Remote Code Execution via Velocity Template\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/solr_velocity_rce.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/solr_velocity_rce\", \"references\": [\"EDB-47572\", \"CVE-2019-17558\", \"URL-https://www.tenable.com/blog/apache-solr-vulnerable-to-remote-code-execution-zero-day-vulnerability\", \"URL-https://www.huaweicloud.com/en-us/notice/2018/20191104170849387.html\", \"URL-https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133/\", \"URL-https://github.com/jas502n/solr_rce\", \"URL-https://github.com/AleWong/Apache-Solr-RCE-via-Velocity-template\"], \"rport\": 8983, \"session_types\": false, \"targets\": [\"Java (in-memory)\", \"Unix (in-memory)\", \"Linux (dropper)\", \"x86/x64 Windows PowerShell\", \"x86/x64 Windows CmdStager\", \"Windows Exec\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:12.301933Z"}