VulnerabilityModified

CVE-2017-12629

CRITICAL 9.8EPSS 91.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 91.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 91.90% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: apache/solr · redhat/jboss enterprise application platform · debian/debian linux · canonical/ubuntu linux
Source: security@apache.org

References

http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3EMailing List, Vendor Advisory
http://openwall.com/lists/oss-security/2017/10/13/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/101261Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3123Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3124Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3244Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3451Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3452Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0002Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0003Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0004Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0005Third Party Advisory
https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E
https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/01/msg00028.htmlMailing List, Third Party Advisory
https://s.apache.org/FJDlExploit, Mailing List, Vendor Advisory
https://twitter.com/ApacheSolr/status/918731485611401216Third Party Advisory
https://twitter.com/joshbressers/status/919258716297420802Third Party Advisory
https://twitter.com/searchtools_avi/status/918904813613543424Third Party Advisory
https://usn.ubuntu.com/4259-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4124Third Party Advisory
https://www.exploit-db.com/exploits/43009/Exploit, Third Party Advisory, VDB Entry
http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3EMailing List, Vendor Advisory
http://openwall.com/lists/oss-security/2017/10/13/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/101261Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3123Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3124Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3244Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.