Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2019-0193

KEV EPSS 93.08% · P100
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2019-0193

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Solr 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Solr是美国阿帕奇（Apache）基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。 Apache Solr 8.2.0之前版本中存在代码注入漏洞。攻击者可利用该漏洞在目标服务器上执行恶意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

VendorProductAffected VersionsCPESubscribe
ApacheApache Solr Apache Solr all prior to 8.2.0 -

II. Public POCs for CVE-2019-0193

#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/xConsoIe/CVE-2019-0193POC Details
2Apache Solr DataImport Handler RCEhttps://github.com/jas502n/CVE-2019-0193POC Details
3Apache Solr远程代码执行漏洞(CVE-2019-0193) Exploithttps://github.com/1135/solr_exploitPOC Details
4Nonehttps://github.com/jaychouzzk/CVE-2019-0193-expPOC Details
5ApacheSolrRCE（CVE-2019-0193）一键写shell，原理是通过代码执行的java文件流写的马。https://github.com/freeFV/ApacheSolrRCEPOC Details
6Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0193.yamlPOC Details
7Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Solr%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-0193.mdPOC Details
8Apache Solr DataImportHandler Remote Code Execution Vulnerability(CVE-2019-0193)https://github.com/chaitin/xray-plugins/blob/main/poc/manual/solr-cve-2019-0193.ymlPOC Details
9https://github.com/vulhub/vulhub/blob/master/solr/CVE-2019-0193/README.mdPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-0193

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Apache Solr
Same vendor: Apache

V. Comments for CVE-2019-0193

No comments yet

Leave a comment