CVE-2019-17558

CVE-2019-17558 is a remote code execution flaw in the VelocityResponseWriter plug-in of Apache Solr 5.0.0 through 8.3.1, caused by improper handling of Velocity template content (CWE-74). An attacker can supply a renderable, potentially malicious Velocity template either from the configset's velocity/ directory or, when a response writer has been configured with params.resource.loader.enabled set to true (which requires Config API access), directly via request parameters; parameter-provided templates are disabled by default and the vulnerable path was removed entirely in Solr 8.4. Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the Solr process, risking compromise of the host and indexed data. Any Solr deployment running 5.0.0–8.3.1 is affected, and Oracle Primavera Unifier is also impacted because it bundles the affected Solr component. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, with EPSS estimating a 98.6% probability of exploitation in the next 30 days.

What to do: Upgrade to Apache Solr 8.4 or later per vendor instructions (CISA's required action). If upgrading is deferred, avoid enabling params.resource.loader.enabled on custom response writers, restrict access to the Solr Config API, limit Solr's network exposure, and review access logs for requests passing velocity template parameters. Oracle Primavera Unifier customers should apply the applicable Oracle Critical Patch Update.