CVE-2017-12629: apache solr

Modified

AliasesMGASA-2017-0403RHSA-2017:3123RHSA-2017:3451+6 more

Published 14-10-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-12629 is a critical (CVSS 9.8) vulnerability in apache solr. EPSS estimates a 91.90% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (exploit-database, 17-10-2017)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

91.90%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 4

DSA-4124-1 RHSA-2018:0002 RHSA-2018:0004 RHSA-2018:0005

Timeline

14-10-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS metrics

7 scores · 5 sources · 3 versions

v3.19.8v3.09.8v2.07.5

EPSS trend

Probability

91.90%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 91.90% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (s.apache.org)
Maturity: unknown
exploit-databasexmlVerified
Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat50 products

jboss_enterprise_application_platform7.0.0 | 7.1.0
eap7-lucene-analyzers-common< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-backward-codecs< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-core< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-facet< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7

eap7-lucene-misc< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-queries< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-queryparser< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
eap7-lucene-solr< 0:5.3.1-4.redhat_2.1.ep7.el6 | < 0:5.3.1-4.redhat_2.1.ep7.el7
rh-java-common-lucene< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-analysis< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-analyzers-phonetic< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-analyzers-smartcn< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-analyzers-stempel< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-classification< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-codecs< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-facet< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-grouping< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-highlighter< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-javadoc< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-join< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-memory< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-misc< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-parent< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-queries< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-queryparser< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-replicator< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-sandbox< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-solr-grandparent< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene-suggest< 0:4.8.0-6.9.el6 | < 0:4.8.0-6.9.el7
rh-java-common-lucene5< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-analysis< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-analyzers-smartcn< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-backward-codecs< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-classification< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-codecs< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-facet< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-grouping< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-highlighter< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-javadoc< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-join< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-memory< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-misc< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-parent< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-queries< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-queryparser< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-replicator< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-sandbox< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-solr-grandparent< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7
rh-java-common-lucene5-suggest< 0:5.4.1-2.4.el6 | < 0:5.4.1-2.4.el7

Show all 50

Debian2 products

lucene-solr< 3.6.2+dfsg-11 | < 3.6.0+dfsg-1+deb7u3
debian_linuxEOL7.0 | 8.0 | 9.0

Apache1 product

solr≥ 5.5.0, ≤ 5.5.4 | ≥ 6.0.0, ≤ 6.6.1 | ≥ 7.0.0, ≤ 7.0.1

Canonical1 product

ubuntu_linuxEOL16.04

Mageia1 product

lucene< 5.5.0-4.1.mga6

Org.apache.solr1 product

solr-core≥ 7.0.0, < 7.1.0 | ≥ 6.0.0, < 6.6.2 | ≥ 5.5.0, < 5.5.5

Ubuntu1 product

lucene-solr< 3.6.2+dfsg-2ubuntu0.1~esm1 | < 3.6.2+dfsg-8ubuntu0.1

7 vendors · 57 products

References

53 links

access.redhat.com/errata/RHSA-2017:3451Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
s.apache.org/FJDlMailing ListX Refsource MLISTExploitVendor AdvisoryWEB
access.redhat.com/errata/RHSA-2018:0002Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
www.securityfocus.com/bid/101261VDB EntryX Refsource BIDThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2018:0004Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2017:3452Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
lists.debian.org/debian-lts-announce/2018/01/msg00028.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
www.exploit-db.com/exploits/43009/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:0003Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2017:3123Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB

Show all 53 references

access.redhat.com/errata/RHSA-2018:0005Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2017:3244Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2017:3124Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
mail-archives.us.apache.org/mod_mbox/…Mailing ListX Refsource MLISTVendor AdvisoryWEB
www.debian.org/security/2018/dsa-4124Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEB
usn.ubuntu.com/4259-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
twitter.com/ApacheSolr/status/918731485611401216X Refsource MISCThird Party AdvisoryWEB
twitter.com/searchtools_avi/status/918904813613543424X Refsource MISCThird Party AdvisoryWEB
openwall.com/lists/oss-security/2017/10/13/1X Refsource MISCMailing ListThird Party AdvisoryWEB
twitter.com/joshbressers/status/919258716297420802X Refsource MISCThird Party AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
advisories.mageia.org/MGASA-2017-0403.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=21976REPORT
lists.fedoraproject.org/archives/…WEB
access.redhat.com/security/vulnerabilities/CVE-2017-12629ARTICLE
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1501529REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3123.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-12629REPORT
www.cve.org/CVERecord?id=CVE-2017-12629AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2017-12629Advisory
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3451.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3452.jsonAdvisory
ubuntu.com/security/CVE-2017-12629REPORT
mail-archives.apache.org/mod_mbox/…REPORT
ubuntu.com/security/notices/USN-4259-1Advisory
security-tracker.debian.org/tracker/CVE-2017-12629Advisory
github.com/apache/lucene-solr/commit/3bba91131b5257e64b9d0a2193e1e32a145b2a2WEB
github.com/apache/lucene-solr/commit/d8000beebfb13ba0b6e754f84c760e11592d8d1WEB
github.com/apache/lucene-solr/commit/f9fd6e9e26224f26f1542224ce187e04c27b268WEB
www.exploit-db.com/exploits/43009WEB
usn.ubuntu.com/4259-1WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
issues.apache.org/jira/browse/SOLR-11477WEB
github.com/apache/lucenePACKAGE
github.com/advisories/GHSA-mh7g-99w9-xpjmAdvisory