CVE-2017-12629 Public exploit EPSS 91.9%

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction…

Summary

Apache Solr before 7.1 (built on Apache Lucene before 7.1) contains an XML external entity (XXE) flaw in its XML Query Parser, which is enabled by default, and remote code execution is possible by combining XXE with the Config API add-listener command to reach the RunExecutableListener class. An attacker who can send query requests with deftype=xmlparser can use the XXE to upload malicious data to the /upload request handler or read arbitrary local files via a blind XXE over the ftp wrapper, and the RunExecutableListener route reaches code execution on all affected Solr versions.

Official description · CVE.org

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

Breakdown

26.3 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) appeared 3 days after disclosure. No confirmed exploitation is recorded.

Disclosed14 Oct 2017day 0
Public exploit codeExploit-DB17 Oct 2017+3 days

8 fixes in solr-core over 20 months. The latest fix listed for solr-core is 7.4.0.

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.4.1CVE-2017-316330 Aug 2017
6.6.0CVE-2017-76607 Jul 2017
6.6.1CVE-2017-980318 Sep 2017
7.0.0CVE-2019-01927 Mar 2019
7.1.0CVE-2017-1262914 Oct 2017
7.3.0CVE-2018-13089 Apr 2018
7.3.1CVE-2018-801021 May 2018
7.4.0CVE-2018-80265 Jul 2018Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.solr:solr-core.

Mavenorg.apache.solr:solr-coreGHSA-mh7g-99w9-xpjm

Upgrade to 7.1.0

Still affected on this line by CVE-2019-0193 (fixed in 8.2.0, a newer line); CVE-2019-17558 (fixed in 8.4.0, a newer line); CVE-2020-13957 (fixed in 8.6.3, a newer line); CVE-2023-50386 (fixed in 8.11.3, a newer line).

Set the version to 7.1.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2017-12629.

Affected versions, by release line

If you run	Upgrade to
7.0.0 up to 7.1.0	7.1.0
6.0.0 up to 6.6.2 Still affected on this line by CVE-2019-0192 (fixed in 7.0.0, a newer line); CVE-2019-0193 (fixed in 8.2.0, a newer line); CVE-2019-17558 (fixed in 8.4.0, a newer line); CVE-2020-13957 (fixed in 8.6.3, a newer line); CVE-2023-50386 (fixed in 8.11.3, a newer line).	6.6.2
5.5.0 up to 5.5.5 Still affected on this line by CVE-2019-0192 (fixed in 7.0.0, a newer line); CVE-2019-0193 (fixed in 8.2.0, a newer line); CVE-2019-17558 (fixed in 8.4.0, a newer line).	5.5.5

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

24 links, grouped by NVD tag

vendor-advisory 11

access.redhat.com/errata/RHSA-2017:3451 access.redhat.com/errata/RHSA-2018:0002 access.redhat.com/errata/RHSA-2018:0004 access.redhat.com/errata/RHSA-2017:3452 access.redhat.com/errata/RHSA-2018:0003 access.redhat.com/errata/RHSA-2017:3123 access.redhat.com/errata/RHSA-2018:0005 access.redhat.com/errata/RHSA-2017:3244

Show 3 moreShow fewer

access.redhat.com/errata/RHSA-2017:3124 debian.org/security/2018/dsa-4124 usn.ubuntu.com/4259-1/

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2018-0640

Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code ExecutionEDB-43009 · webapps · xml · 2017-10-17 · verified

, 30 Oct 2026

91.9%Top 0.18%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.82%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9982 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 2 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses3 pulses 1.4/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total26.3

Record

Published: 14 Oct 2017
Modified: 5 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in solr-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 3 community threat pulses (AlienVault OTX)

References

vendor-advisory 11

mailing-list 7

vdb-entry 1

exploit 1

x_refsource_MISC 4

techniques