CVE-2017-12629 in the critical feed json
Remote code execution occurs in Apache Solr
published 2017-10-14 9 y ago modified 2026-06-17 4 mo ago also GHSA-mh7g-99w9-xpjm , EUVD-2018-0640
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 91.9%
- EPSS 91.9% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Patch / fix
- maven org.apache.solr:solr-core 5.5.5, 6.6.2, 7.1.0
- n/a Apache Solr before 7.1 with Apache Lucene before 7.1 5.3.1-redhat-2, 5.5.5, 6.6.2, 7.1.0, lucene-solr 7.2.0, lucene-solr 8.0.0
- lucene-solr Debian 14, Debian 13, Debian 12 3.6.2+dfsg-11
debian advisories DEBIAN-CVE-2017-12629
- lucene-solr Ubuntu 16.04 LTS 3.6.2+dfsg-8ubuntu0.1
- lucene-solr Ubuntu Pro 14.04 LTS 3.6.2+dfsg-2ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2017-12629
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap7-jboss-ec2-eap jboss enterprise application platform 7 7.0.9-2.GA_redhat_2.ep7.el6
- eap7-jboss-ec2-eap jboss enterprise application platform 7 7.0.9-2.GA_redhat_2.ep7.el7
- eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.0.9-2.GA_redhat_2.ep7.el6
- eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.0.9-2.GA_redhat_2.ep7.el7
- eap7-jgroups jboss enterprise application platform 7 3.6.12-1.Final_redhat_1.1.ep7.el7
- eap7-wildfly jboss enterprise application platform 7 7.0.9-4.GA_redhat_3.1.ep7.el7
- eap7-resteasy jboss enterprise application platform 7 3.0.19-7.SP5_redhat_1.1.ep7.el7
- eap7-undertow jboss enterprise application platform 7 1.3.31-3.Final_redhat_3.1.ep7.el7
red hat advisories RHSA-2018:0005RHSA-2018:0004RHSA-2018:0002RHSA-2017:3452RHSA-2017:3451RHSA-2017:3123
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-12629 updated cvss 9.8
Solr: Code execution via entity expansion
-
Red Hat Enterprise Linux 6 lucene, lucene-demo, lucene-contrib, lucene-javadocaffected: workaround, no fix planned “Will not fix”
-
Red Hat JBoss Data Grid 7 luceneaffected: workaround, no fix available
-
Red Hat JBoss Data Grid 7.1fixed: vendor fix RHSA-2017:3244
-
Red Hat JBoss EAP 7.0fixed: vendor fix RHSA-2018:0003
-
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-wildfly 7.0.9-4.GA_redhat_3.1.ep7.el6, eap7-lucene-core 5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-misc 5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-solr 5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-facet 5.3.1-4.redhat_2.1.ep7.el6, eap7-resteasy 3.0.19-7.SP5_redhat_1.1.ep7.el6, +59 morefixed: vendor fix RHSA-2018:0002
-
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-wildfly 7.0.9-4.GA_redhat_3.1.ep7.el7, eap7-lucene-core 5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-misc 5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-solr 5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-facet 5.3.1-4.redhat_2.1.ep7.el7, eap7-resteasy 3.0.19-7.SP5_redhat_1.1.ep7.el7, +59 morefixed: vendor fix RHSA-2018:0005
-
Red Hat JBoss Enterprise Application Platform 7.0 security updatefixed: vendor fix RHSA-2017:3124
-
Red Hat JBoss Enterprise Application Platform Continuous Deliveryfixed: vendor fix RHSA-2020:2561
show 3 moreshow fewer
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-lucene 4.8.0-6.9.el6, rh-java-common-lucene5 5.4.1-2.4.el6, rh-java-common-lucene-join 4.8.0-6.9.el6, rh-java-common-lucene-misc 4.8.0-6.9.el6, rh-java-common-lucene-facet 4.8.0-6.9.el6, rh-java-common-lucene5-join 5.4.1-2.4.el6, +35 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-lucene 4.8.0-6.9.el7, rh-java-common-lucene5 5.4.1-2.4.el7, rh-java-common-lucene-join 4.8.0-6.9.el7, rh-java-common-lucene-misc 4.8.0-6.9.el7, rh-java-common-lucene-facet 4.8.0-6.9.el7, rh-java-common-lucene5-join 5.4.1-2.4.el7, +35 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-lucene 4.8.0-6.9.el6, rh-java-common-lucene5 5.4.1-2.4.el6, rh-java-common-lucene-join 4.8.0-6.9.el6, rh-java-common-lucene-misc 4.8.0-6.9.el6, rh-java-common-lucene-facet 4.8.0-6.9.el6, rh-java-common-lucene5-join 5.4.1-2.4.el6, +35 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-lucene 4.8.0-6.9.el7, rh-java-common-lucene5 5.4.1-2.4.el7, rh-java-common-lucene-join 4.8.0-6.9.el7, rh-java-common-lucene-misc 4.8.0-6.9.el7, rh-java-common-lucene-facet 4.8.0-6.9.el7, rh-java-common-lucene5-join 5.4.1-2.4.el7, +35 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-java-common-lucene 4.8.0-6.9.el7, rh-java-common-lucene5 5.4.1-2.4.el7, rh-java-common-lucene-join 4.8.0-6.9.el7, rh-java-common-lucene-misc 4.8.0-6.9.el7, rh-java-common-lucene-facet 4.8.0-6.9.el7, rh-java-common-lucene5-join 5.4.1-2.4.el7, +35 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-lucene 4.8.0-6.9.el6, rh-java-common-lucene5 5.4.1-2.4.el6, rh-java-common-lucene-join 4.8.0-6.9.el6, rh-java-common-lucene-misc 4.8.0-6.9.el6, rh-java-common-lucene-facet 4.8.0-6.9.el6, rh-java-common-lucene5-join 5.4.1-2.4.el6, +35 morefixed: vendor fix RHSA-2017:3451
+1 more productsfewer
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-lucene 4.8.0-6.9.el7, rh-java-common-lucene5 5.4.1-2.4.el7, rh-java-common-lucene-join 4.8.0-6.9.el7, rh-java-common-lucene-misc 4.8.0-6.9.el7, rh-java-common-lucene-facet 4.8.0-6.9.el7, rh-java-common-lucene5-join 5.4.1-2.4.el7, +35 more -
Red Hat RHPAM 7.13.1 asyncfixed: vendor fix RHSA-2023:1334
-
Red Hat BPM Suite 6 lucene Red Hat Enterprise Linux 5 lucene Red Hat Fuse 7 solr solr Red Hat JBoss BRMS 6 lucene Red Hat JBoss Enterprise Application Platform 6 lucene, solr solr Red Hat JBoss Fuse 6 camelnot affected: vulnerable code not present
+5 more productsfewer
Red Hat JBoss Portal 6 solr solr Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6 Red Hat Single Sign-On 7 lucene Red Hat Virtualization 4 lucene
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (EDB-43009)
Exploit prediction
91.90% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-43009 Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution webapps, 2017-10-17
- Nuclei template Apache Solr <= 7.1 - XML Entity Injection nuclei detection template
- s.apache.org https://s.apache.org/FJDl referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.solr:solr-core | >=7.0.0, <7.1.0 >=6.0.0, <6.6.2 >=5.5.0, <5.5.5 |
7.1.0 6.6.2 5.5.5 |
Affected products
- n/a Apache Solr before 7.1 with Apache Lucene before 7.1
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/apache/lucene-solr/commit/3bba91131b5257e64b9d0a2193e1e32a145b2a2
web
-
github.com
/apache/lucene-solr/commit/d8000beebfb13ba0b6e754f84c760e11592d8d1
web
-
github.com
/apache/lucene-solr/commit/f9fd6e9e26224f26f1542224ce187e04c27b268
web
-
exploit-db.com
/exploits/43009/
exploit, third-party-advisory, vdb-entry
-
s.apache.org
/FJDl
mailing-list, web, exploit, vendor-advisory
-
access.redhat.com
/errata/RHSA-2017:3451
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0002
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0004
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3452
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0003
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3123
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0005
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3244
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3124
vendor-advisory, web, third-party-advisory
-
debian.org
/security/2018/dsa-4124
vendor-advisory, web, third-party-advisory
-
usn.ubuntu.com
/4259-1/
vendor-advisory, third-party-advisory
-
mail-archives.us.apache.org
/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com
mailing-list, web, vendor-advisory
-
securityfocus.com
/bid/101261
vdb-entry, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2018/01/msg00028.html
mailing-list, web, third-party-advisory
-
twitter.com
/ApacheSolr/status/918731485611401216
web, third-party-advisory
-
twitter.com
/searchtools_avi/status/918904813613543424
web, third-party-advisory
-
openwall.com
/lists/oss-security/2017/10/13/1
web, mailing-list, third-party-advisory
-
twitter.com
/joshbressers/status/919258716297420802
web, third-party-advisory
-
lists.apache.org
/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2017-12629
advisory
-
exploit-db.com
/exploits/43009
web
-
usn.ubuntu.com
/4259-1
web
-
lists.apache.org
/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E
web
-
lists.apache.org
/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E
web
-
lists.apache.org
/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E
web
-
lists.apache.org
/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E
web
-
issues.apache.org
/jira/browse/SOLR-11477
web
-
github.com
/apache/lucene
package
-
github.com
/advisories/GHSA-mh7g-99w9-xpjm
advisory
Sources
- CVE List CVE-2017-12629
- GitHub Advisory GHSA-mh7g-99w9-xpjm
- NVD CVE-2017-12629
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.