Vulnerability record · CVE-2017-12629 · published 14 October 2017
CVE-2017-12629: Apache Solr XXE chained to RunExecutableListener remote code execution
Apache · Solr
Apache Solr before 7.1 (with Apache Lucene before 7.1) is affected by an XML external entity flaw in the XML Query Parser, reachable by default via deftype=xmlparser, which can read local files or upload malicious data through the /upload handler. The same record describes a second flaw: the Config API add-listener command can reach RunExecutableListener, giving remote code execution on all affected versions. The combination is severe because it is network-reachable with no authentication or user interaction and yields full confidentiality, integrity and availability impact.
Description
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction, full impact across confidentiality, integrity and availability, and very high EPSS with public exploit references.
What it is
Apache Solr before 7.1 (with Apache Lucene before 7.1) is affected by an XML external entity flaw in the XML Query Parser, reachable by default via deftype=xmlparser, which can read local files or upload malicious data through the /upload handler. The same record describes a second flaw: the Config API add-listener command can reach RunExecutableListener, giving remote code execution on all affected versions. The combination is severe because it is network-reachable with no authentication or user interaction and yields full confidentiality, integrity and availability impact.
Impact
An unauthenticated attacker can read arbitrary local files from the Solr server and, by chaining the XXE with the RunExecutableListener path, execute arbitrary code on the host. That gives full control of the Solr process and its data.
Attack surface
Reached over the network through Solr's HTTP interface: the XML Query Parser is available by default on query requests using deftype=xmlparser, and the Config API add-listener command is exposed on affected versions. The CVSS vector shows no privileges required and no user interaction, so any reachable Solr endpoint is a candidate.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.91896 probability, 99.812 percentile) and public references carry Exploit tags, including an Exploit-DB entry and an Apache mailing-list post, indicating public exploit material exists.
What to do
- Upgrade Apache Solr to 7.1 or later, and apply the corresponding Red Hat, Debian and Ubuntu errata for packaged deployments.
- If immediate upgrade is not possible, restrict network access to Solr so only trusted clients can reach query and Config API endpoints.
- Disable or block the XML Query Parser (deftype=xmlparser) and the /upload request handler where they are not required.
- Disable external entity processing in the XML parser configuration and remove or restrict the Config API add-listener capability.
- Run Solr with least privilege and no unnecessary filesystem or process execution rights to limit the impact of a successful chain.
Detection
- Monitor Solr query requests for deftype=xmlparser and for XML payloads containing DOCTYPE or external entity declarations.
- Alert on requests to the /upload handler and on Config API add-listener calls, especially from unexpected source addresses.
- Watch for Solr child processes or outbound FTP/HTTP connections consistent with blind XXE file exfiltration.
- Review Solr logs and host process telemetry for unexpected executable launches originating from the Solr service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-12629 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-12629), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
