CVE-2019-0193

What is Apache Solr?

Apache Solr is a widely deployed open-source enterprise search platform built on Apache Lucene, used to power search functionality for e-commerce sites, internal document repositories, and countless other applications that need fast, full-text search. Its DataImportHandler module is an optional add-on that lets Solr pull data directly from databases, files, and other sources into its search index — functionality powerful enough that, if abused, it can be turned against the server hosting it.

Overview

CVE-2019-0193 is a code injection vulnerability in Solr's DataImportHandler module. The handler supports a "ScriptTransformer" feature that allows administrators to embed a scripting language (such as JavaScript, via Java's built-in scripting engine) directly within the dataConfig configuration used to define an import job. If an attacker can control or influence this dataConfig parameter — which was possible on servers where the DataImportHandler was enabled and reachable without adequate access controls — they could inject arbitrary script code that executes with the privileges of the Solr server process, resulting in remote code execution.

Technical Details

The root cause (CWE-94, Code Injection) is that the DataImportHandler's scripting transformer feature evaluates attacker-influenced configuration content as executable code rather than treating it strictly as data. Because the dataConfig parameter can, in vulnerable configurations, be supplied via an HTTP request to Solr's admin/import endpoints, an attacker with network access to a Solr instance exposing this handler could submit a crafted request containing malicious script content and have it executed on the server — no separate authentication was required, since Solr instances of this era commonly ran without any built-in authentication at all.

Discovery

Addressed through the Apache Solr project's standard security release and advisory process.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in the wild. Solr instances have long been a favorite opportunistic target for internet-wide scanning because many deployments historically ran with no authentication enabled and exposed administrative functionality directly to the internet; DataImportHandler-based RCE bugs like this one have been used for cryptocurrency mining, botnet recruitment, and broader server compromise campaigns.

Remediation

1. Upgrade to a patched Apache Solr release that addresses this DataImportHandler code injection issue.
2. Disable the DataImportHandler module entirely if it is not required for your deployment.
3. Restrict network access to Solr's admin and import endpoints to trusted internal networks only — never expose them directly to the internet.
4. Enable Solr's built-in authentication and authorization mechanisms, which were historically disabled by default in many deployments.
5. Review Solr access logs for anomalous dataConfig parameters or unexpected import requests predating remediation.