CVE-2017-12629

Scores

EPSS

0.939high93.9%
0%20%40%60%80%100%

Percentile: 93.9%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-138CWE-611

Related Vulnerabilities

Exploits

Exploit ID: 43009

Source: exploitdb

URL: https://www.exploit-db.com/exploits/43009

Exploit ID: CVE-2017-12629

Source: github-poc

URL: https://github.com/captain-woof/cve-2017-12629

Recommendations

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2017:3452

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2017:3451

Source: nvd

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
The References section of this erratum contains a download link (you must log in to download the update).

URL: https://access.redhat.com/errata/RHSA-2017:3124

Source: nvd

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2017:3123

Vulnerable Software (47)

Type: Configuration

Product: eap7-activemq-artemis

Operating System: rhel

Trait:
{  "fixed": "1.1.0-19.SP24_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-activemq-artemis

Operating System: rhel

Trait:
{  "fixed": "1.1.0-19.SP24_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-hibernate

Operating System: rhel

Trait:
{  "fixed": "5.0.16-1.Final_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-hibernate

Operating System: rhel

Trait:
{  "fixed": "5.0.16-1.Final_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-ironjacamar

Operating System: rhel

Trait:
{  "fixed": "1.3.8-1.Final_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-ironjacamar

Operating System: rhel

Trait:
{  "fixed": "1.3.8-1.Final_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-jboss-ec2-eap

Operating System: rhel

Trait:
{  "fixed": "7.0.9-2.GA_redhat_2.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-jboss-ec2-eap

Operating System: rhel

Trait:
{  "fixed": "7.0.9-2.GA_redhat_2.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-jboss-remoting

Operating System: rhel

Trait:
{  "fixed": "4.0.25-1.Final_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-jboss-remoting

Operating System: rhel

Trait:
{  "fixed": "4.0.25-1.Final_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-jboss-xnio-base

Operating System: rhel

Trait:
{  "fixed": "3.4.7-1.Final_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-jboss-xnio-base

Operating System: rhel

Trait:
{  "fixed": "3.4.7-1.Final_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-jgroups

Operating System: rhel

Trait:
{  "fixed": "3.6.12-1.Final_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-jgroups

Operating System: rhel

Trait:
{  "fixed": "3.6.12-1.Final_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-lucene-solr

Operating System: rhel

Trait:
{  "fixed": "5.3.1-4.redhat_2.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-lucene-solr

Operating System: rhel

Trait:
{  "fixed": "5.3.1-4.redhat_2.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-resteasy

Operating System: rhel

Trait:
{  "fixed": "3.0.19-7.SP5_redhat_1.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-resteasy

Operating System: rhel

Trait:
{  "fixed": "3.0.19-7.SP5_redhat_1.1.ep7.el7"}

Source: redhat

Type: Configuration

Product: eap7-undertow

Operating System: rhel

Trait:
{  "fixed": "1.3.31-3.Final_redhat_3.1.ep7.el6"}

Source: redhat

Type: Configuration

Product: eap7-undertow

Operating System: rhel

Trait:
{  "fixed": "1.3.31-3.Final_redhat_3.1.ep7.el7"}

Source: redhat