CVE-2017-12629 Remote code execution occurs in Apache Solr
Attackers can achieve remote code execution and read arbitrary files via XXE in the XML Query Parser and Config API listener.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12629?
CVE-2017-12629 is a critical vulnerability in Canonical Ubuntu Linux, published on 14 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Weakness: CWE-611
Which versions are affected by CVE-2017-12629?
6 open source packages ship an affected version, including org.apache.solr:solr-core. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.solr:solr-core Maven | From 5.5.0 | 5.5.5 |
org.apache.solr:solr-core Maven | From 5.5.0 | 5.5.5 |
org.apache.solr:solr-core Maven | From 6.0.0 | 6.6.2 |
org.apache.solr:solr-core Maven | From 6.0.0 | 6.6.2 |
org.apache.solr:solr-core Maven | From 7.0.0 | 7.1.0 |
org.apache.solr:solr-core Maven | From 7.0.0 | 7.1.0 |
Linux distribution packages (34)
eap7-lucene-analyzers-common Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-backward-codecs Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-core Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-facet Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-misc Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-queries Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-queryparser Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-solr Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el6 |
eap7-lucene-analyzers-common Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-backward-codecs Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-core Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-facet Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-misc Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-queries Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-queryparser Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
eap7-lucene-solr Red Hat:jboss_enterprise_application_platform:7::el7 | All versions | 0:5.3.1-4.redhat_2.1.ep7.el7 |
rh-java-common-lucene Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-analysis Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-analyzers-phonetic Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-analyzers-smartcn Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-analyzers-stempel Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-classification Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-codecs Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-facet Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-grouping Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-highlighter Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-javadoc Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-join Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-memory Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-misc Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-parent Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-queries Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-queryparser Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
rh-java-common-lucene-replicator Red Hat:rhel_software_collections:3::el6 | All versions | 0:4.8.0-6.9.el6 |
Products include Apache Solr, Canonical Ubuntu Linux, Debian Debian Linux, Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2017-12629?
Upgrade org.apache.solr:solr-core to a fixed version for your release line: 5.5.5, 6.6.2 or 7.1.0.
Is CVE-2017-12629 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-12629 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2021-27905 SSRF vulnerability with the Replication handler
Sources
Also known as DEBIAN-CVE-2017-12629, DLA-1254-1, GHSA-mh7g-99w9-xpjm, MGASA-2017-0403, RHSA-2017:3123, RHSA-2017:3451 and 3 more.