Apache Solr Velocity Template Injection Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2019-17558)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Solr versions 5.0.0 through 8.3.1
Remote attackers can modify Solr configurations via the Config API to enable the Velocity template loader and execute arbitrary system commands on the host
Upgrade to Apache Solr 8.4.0 or later, or disable the 'params.resource.loader.enabled' setting and restrict access to the Config API
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache Solr to version 8.4.0 or later, where the parameter resource loader has been completely removed.
# Example: Upgrading Solr on Debian/Ubuntu systems
export SOLR_VERSION='8.4.0'
wget https://archive.apache.org/dist/lucene/solr/${SOLR_VERSION}/solr-${SOLR_VERSION}.tgz
tar xzf solr-${SOLR_VERSION}.tgz solr-${SOLR_VERSION}/bin/install_solr_service.sh --strip-components=2
sudo ./install_solr_service.sh solr-${SOLR_VERSION}.tgz -i /opt -d /var/solr -u solr -s solr -p 89832. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable the parameter resource loader for all active cores via the Config API and restrict network access.
# Disable params.resource.loader.enabled on the target core
curl -X POST -H 'Content-type:application/json' -d '{
"update-queryresponsewriter": {
"name": "velocity",
"class": "solr.VelocityResponseWriter",
"params.resource.loader.enabled": "false"
}
}' http://localhost:8983/solr/YOUR_CORE_NAME/config3. Log Audit & IoC Verification Commands
Scan Solr request logs for indicators of compromise, specifically looking for requests containing wt=velocity or modifications to the config endpoint.
# Search for Velocity template injection attempts in Solr logs
grep -Ei 'wt=velocity' /var/solr/logs/solr.log
grep -Ei 'params.resource.loader.enabled' /var/solr/logs/solr.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-17558) is a Remote Code Execution (RCE) flaw in Apache Solr's VelocityResponseWriter. Solr allows using the Velocity template engine to customize search response rendering. By default, the parameter-provided template loader (params.resource.loader.enabled) is disabled. However, a design flaw allows users with access to the Solr Config API to dynamically modify this configuration to true. If the Config API is exposed without proper authentication, an attacker can enable this feature and inject malicious templates.
2. Exploitation Mechanics & Attack Scenario
The attack is executed in two distinct phases: 1) Configuration Modification: The attacker sends an HTTP POST request to the /config endpoint of a Solr core to define or update a VelocityResponseWriter with params.resource.loader.enabled set to true. 2) Code Execution: Once enabled, the attacker sends a /select query request with wt=velocity and injects malicious Velocity Template Language (VTL) code via the v.template parameter. The Velocity engine processes this input, allowing the attacker to instantiate Java classes (e.g., java.lang.Runtime) and execute arbitrary OS commands.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog with an extremely high EPSS score. Successful exploitation grants the attacker shell access with the privileges of the Solr process. This can lead to full system compromise, lateral movement within the internal network, data exfiltration, and deployment of ransomware or cryptominers.
Official Vendor Advisories & References
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Frequently Asked SecOps Questions (CVE-2019-17558)
FAQQ1. How critical is CVE-2019-17558 and is it actively exploited in the wild?
CVE-2019-17558 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 98.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-17558?
Primary impacted vendors include apache across solr. Scope summary: Apache Solr versions 5.0.0 to 8.3.1 (Fixed in 8.4.0)
Q3. What temporary mitigations or workarounds exist for CVE-2019-17558 before patching?
[Mitigation] Upgrade to Apache Solr 8.4.0 or later, or disable the 'params.resource.loader.enabled' setting and restrict access to the Config API Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-17558
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.