CVE-2019-17558

What is Apache Solr?

Apache Solr is a popular open-source enterprise search platform built on Apache Lucene, used to power search functionality for websites, e-commerce platforms, and internal enterprise search tools. Solr exposes an HTTP API for indexing and querying data, and includes optional response-writer plugins that render query results using different templating engines — flexibility that, if misconfigured, can expose dangerous functionality to remote users.

Overview

CVE-2019-17558 is a remote code execution vulnerability in Apache Solr's VelocityResponseWriter plugin. When a Solr collection has the params resource loader enabled for Velocity templates (a configuration that was permitted, and in some deployment guides even suggested, prior to this disclosure), a remote attacker can supply a malicious Velocity template via request parameters that executes arbitrary Java code on the server. CVSS 3.1 base score 7.5 (High).

Technical Details

This is CWE-74 (Improper Neutralization of Special Elements, i.e., server-side template injection). Apache Velocity is a Java-based templating engine, and its templates can execute arbitrary Java code by design when the engine is configured to trust template content from an uncontrolled source. Solr's VelocityResponseWriter, combined with a params resource loader configuration, allowed an attacker to submit a crafted Velocity template directly as an HTTP request parameter rather than requiring the template to already exist as a trusted file on the server — turning a query-formatting feature into a direct code-execution primitive.

Discovery

The vulnerability was reported through Apache's security process and addressed by the Solr project, which changed the default configuration to disable the dangerous params resource loader option and published guidance for administrators to review existing configurations for the unsafe setting.

Exploitation Context

CISA added CVE-2019-17558 to the KEV catalog in November 2021. Public proof-of-concept exploits circulated widely after disclosure, and unpatched or misconfigured Solr instances exposed to the internet were mass-scanned and compromised, including for cryptocurrency-mining malware deployment and, in some reported cases, use by botnet operators such as those behind the Muhstik botnet.

Remediation

1. Upgrade Apache Solr to a version that disables the vulnerable params resource loader by default, per the Solr security advisory for CVE-2019-17558.
2. Audit solrconfig.xml for any collection using the VelocityResponseWriter with the params resource loader enabled, and disable it if not strictly required.
3. Restrict network access to the Solr admin and query APIs to trusted hosts only — Solr should not be directly exposed to the internet.
4. Scan systems for indicators of cryptomining malware or unexpected processes if an internet-facing Solr instance was running an affected configuration.
5. Apply the principle of least functionality: disable any Solr response-writer or plugin not actively needed by your application.