cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF 报告 在 Apache Solr 中对 Velocity 模板注入漏洞进行实际利用，从自动化工具（Metasploit）的一个缺陷演进到成功的手动利用。 本报告记录了该练习的完整推理过程，重点在于诊断工具失败的原因并转向手动利用。 场景 项目| 描述 ---|--- 目标| 运行 Apache Solr 的 Linux 服务器，端口 8983 目的| 读取敏感文件（/home/favoritebook.txt）的内容 漏洞| CVE-2019-17558（通过 Velocity Response Writer 实现...

CVE-2026-44825-Apache-Solr-Scanner

CVE-2026-44825 Escáner de Apache Solr Este repositorio contiene un escáner basado en Go para detectar y probar instancias de Apache Solr que puedan estar afectadas por CVE-2026-44825, relacionado con condiciones de Ejecución Remota de Código RCE mediante Velocity Template. La herramienta puede...

CVE-2019-17558_Solr_Vul_Tool

Solr Velocity模板注入漏洞检测工具 工具介绍 19年10月底爆出了Solr Velocity模板注入远程命令执行漏洞，人工检测该漏洞需burp抓包改包来回好几次，效率较低，写了这个小工具，支持一键检测漏洞、执行命令、反弹shell，欢迎提issue。该工具仅限安全从业者在法律法规允许的范围内使用，违规使用后果自负。 运行环境 跨平台，JRE=1.8。 （为精简文件大小，单独为每个平台打包SWT库，下载对应平台jar即可） 运行方式 win：java -jar SolrVulScan1.0-win64.jar linux：java -jar...

CVE-2024-5082

概述 此仓库包含 CVE-2024-5082 的 Python 概念验证代码，这是 Sonatype Nexus Repository Manager 2 中的一个远程代码执行漏洞。 该漏洞允许具有足够权限的用户发布特制的 Maven 工件，并将其标记为由 Velocity 内容生成器处理。当检索该工件时，Velocity 模板会被 Nexus 解析，并可能在 Nexus JVM 的安全上下文中执行命令。 根据 Sonatype 的说法： 受影响版本包括 Nexus Repository Manager 2.x 至 2.15.1 ； 该问题已在 2.15.2 中修复； Nexus...

CVE-2021-26084

CVE-2021-26084 影响范围 版本 6.13.23 6.14.0 ≤ 版本 7.4.11 7.5.0 ≤ 版本 7.11.6 7.12.0 ≤ 版本 7.12.5 原因与利用方式 Confluence 使用框架将 URL 映射到 Java 类，从而创建所谓的“action”。Action URL 以“.action”结尾，并在 confluence-.jar 的 xwork.xml 文件以及附带插件的 JAR 文件中的 atlassian-plugin.xml 文件中定义。每个 action 至少包含一个 name 属性（定义 action 名称）、一个 class 属性（定义...

solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 solr简介 Solr是Apache Lucene项目的开源企业搜索平台。...

XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)

XWiki = 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic. id: CVE-2025-51991 info: name: XWiki = 17.3.0 -...

CVE-2020-13957

Apache Solr RCE CVE-2020-13957 Docker 演示 Mac 演示 NVD CVE-2020-13957 描述 NVD CVE-2020-13957 root@kitploit: Apache Solr 6.6.0 至 6.6.6、7.0.0 至 7.7.3 以及 8.0.0 至 8.6.2 版本阻止了一些被视为危险的特性（这些特性可能被用于远程代码执行）在通过 API 无需身份验证/授权上传的 ConfigSet 中进行配置。通过使用 UPLOAD/CREATE 操作的组合，可以绕过为防止此类特性而设置的检查。 Docker 搭建 PoC 环境 1. 根据...

CVE-2026-49833

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

CVE-2026-49833 DSpace: Path Traversal possible in LDN message generation

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

CVE-2026-49833 DSpace: Path Traversal possible in LDN message generation

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

DSpace: Path Traversal is possible through LDN message generation

Overview A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an...

Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 Apache Solr Scanner This repository contains a...

CVE-2026-41258 OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The...

Prototype Pollution

Overview velocityjs is a Velocity Template LanguageVTL for JavaScript Affected versions of this package are vulnerable to Prototype Pollution through the processing of set directives in templates. An attacker can modify the global object prototype by supplying specially crafted template content,...

CVE-2025-12107

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...

CVE-2025-12107

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...

CVE-2025-12107

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...

CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...

CVE-2025-12107

CVE-2025-12107 is linked to a server-side template injection (SSTI) vulnerability in a vulnerable third-party Velocity template engine used by WSO2 Identity Server. An attacker with administrative privileges can inject and execute arbitrary template code on the server, potentially leading to remo...