CVE-2019-0192 - Remote Code Execution via Unsafe Deserialization

[princechaddha]

Is there an existing template for this?

• I have searched the existing templates.

Template requests

Description:
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows attackers to configure the JMX server via an HTTP POST request. By directing it to a malicious RMI server, this vulnerability can be exploited to trigger unsafe deserialization, leading to remote code execution on the Solr server.

Severity: Critical

POC:

• https://github.com/Imanfeng/Apache-Solr-RCE
• https://github.com/mpgn/CVE-2019-0192
• https://github.com/Rapidsafeguard/Solr-RCE-CVE-2019-0192

References:

• Apache Advisory
• SecurityFocus
• RedHat Advisory

Shodan Query:
cpe:"cpe:2.3:a:apache:solr"

CPE:
cpe:2.3:a:apache:solr::::::::
cpe:2.3:a:netapp:storage_automation_store:-:::::::*

Anything else?

No response