CoreCVE
Back

CRITICAL

Solr: Code execution via entity expansion

Published Oct 14, 2017

Description

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

Affected products

Remediation

Red Hat statement

The following products are not affected by this flaw, as they do not use the vulnerable functionality of either aspect of the issue. Red Hat JBoss Enterprise Application Platform 6 Red Hat JBoss BPM Suite Red Hat JBoss BRMS Red Hat Enterprise Virtualization Manager Red Hat Single Sign-On 7 Red Hat JBoss Portal Platform 6 Red Hat JBoss Enterprise Application Platform 7 is not affected by this flaw. However, it does ship the vulnerable Lucene class in a dependency to another component. Customers who reuse the lucene-queryparser jar in their applications may be vulnerable to the External Entity Expansion aspect of this flaw. This will be patched in a forthcoming release. Red Hat JBoss Fuse is not affected by this flaw, as it does not use the vulnerable functionality of either aspect of this flaw. Fuse customers who may be running external Solr servers, while not affected from the Fuse side, are advised to secure their Solr servers as recommended in the mitigation provided. The following products ship only the Lucene components relevant to this flaw, and are not vulnerable to the second portion of the vulnerability, the code execution exploit. As such, the impact of this flaw has been determined to be Moderate for these respective products: Red Hat JBoss Data Grid 7 Red Hat Enterprise Linux 6 Red Hat Software Collections 2.4 This issue did not affect the versions of lucene as shipped with Red Hat Enterprise Linux 5. This issue does not affect Elasticsearch as shipped in OpenShift Container Platform.

Red Hat mitigation

Until fixes are available, all Solr users are advised to restart their Solr instances with the system parameter `-Ddisable.configEdit=true`. This will disallow any changes to be made to configurations via the Config API. This is a key factor in this vulnerability, since it allows GET requests to add the RunExecutableListener to the config. This is sufficient to protect from this type of attack, but means you cannot use the edit capabilities of the Config API until further fixes are in place.

Metrics

Weaknesses (2)

CWE-138

CWE-611

XXE

References (38)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Oct 14, 2017
Updated Aug 5, 2024
Reserved Aug 7, 2017
Link CVE-2017-12629
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-12629
Red Hat
Severity Critical
Public date Oct 12, 2017
Links CVE-2017-12629 - Bugzilla
GHSA-MH7G-99W9-XPJM