Apache-Solr-RCE-via-Velocity-template

Apache-Solr-RCE-via-Velocity-template 참고 링크 취약점 발생 원인: 1. 공격자가 Solr 콘솔에 직접 접근할 수 있는 경우, /노드명/config 형식의 POST 요청을 보내 해당 노드의 구성 파일을 변경할 수 있습니다. 2. Apache Solr는 기본적으로 VelocityResponseWriter 플러그인을 통합합니다. 해당 플러그인의 초기화 매개변수 중 params.resource.loader.enabled 옵션은 매개변수 리소스 로더가 Solr 요청 매개변수에서 템플릿을 지정하도록 허용할...

Exploit for Insecure Default Initialization of Resource in Apache Solr

Mass Reconnaissance & Exploitation Framework for Apache Solr...

VulnCheck KEV: CVE-2019-17558

The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution...

The vulnerability of the VelocityResponseWriter component of the Apache Solr search server, which allows a hacker to execute arbitrary code.

The vulnerability of the VelocityResponseWriter component of the Apache Solr search server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...