CVE-2019-0192

Vulnerability

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows configuration of a JMX server via an HTTP POST request [1][3]. When the handler processes a request to set the jmx.serviceUrl property, it performs unsafe deserialization of objects from the specified RMI server. This affects solr-core Maven package [3].

Exploitation

An attacker sends a crafted HTTP POST request to the Config API endpoint, pointing the jmx.serviceUrl to a malicious RMI server [1][3]. No authentication is required to reach this API. The Solr server then contacts the attacker-controlled RMI server and deserializes arbitrary Java objects supplied by the attacker, allowing code execution without user interaction.

Impact

Successful exploitation results in remote code execution (RCE) in the context of the Solr server process [1][2]. The attacker gains full control over the Solr instance and potentially the underlying host, compromising confidentiality, integrity, and availability of Solr-managed data and the system.

Mitigation

Fixed in Apache Solr version 7.0.0 for all affected branches [1][3]. Red Hat Fuse 7.4.0 includes the fix for Red Hat customers [2]. No workaround is available; users must upgrade to Solr 7.0.0 or later. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.