Apache Solr Exploit - CVE-2019-17558

Apache Solr is a Java-based search platform for enterprise software. Solr supports VelocityResponseWriter, an optional plugin that enables core search features through a Java-based template engine. Apache Solr has a vulnerability in VelocityResponseWriter that allows an attacker to change a configuration value that enables RCE. Specifically, the attacker can define a response writer by setting the params.resource.loader.enabled value to true. (A response writer is an instance of VelocityResponseWriter that processes Solr requests with Velocity templates.) After the configuration is changed, the attacker performs RCE by sending a specially designed HTTP request to the Apache Solr server. The request includes a malicious custom template provided in either a query parameter or a payload in the HTTP request body. The custom template will run on arbitrary commands on the server. For example, an attacker can incorporate shellcode into the custom template to create a reverse shell and run commands on the victim.