XML external entity injection in Apache Solr
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Solr | Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 | — | No fix listed | CNA |
| — | org.apache.solr:solr-core (Maven) | 6.6.0 to before 6.6.4 | 6.6.4 | Patch available | GHSA-rc9v-h28f-jcmf |
| — | org.apache.solr:solr-core (Maven) | 7.0.0 to before 7.3.1 | 7.3.1 | Patch available | GHSA-rc9v-h28f-jcmf |
- Apache Solr VendorApache Affected Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 Fixed in — No fix listed CNA
- org.apache.solr:solr-core (Maven) Vendor— Affected 6.6.0 to before 6.6.4 Fixed in 6.6.4 Patch available GHSA-rc9v-h28f-jcmf
- org.apache.solr:solr-core (Maven) Vendor— Affected 7.0.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-rc9v-h28f-jcmf
Remediation
- Fix · GHSA-rc9v-h28f-jcmf org.apache.solr:solr-core (Maven) Fixed in 6.6.4 Advisory →
- Fix · GHSA-rc9v-h28f-jcmf org.apache.solr:solr-core (Maven) Fixed in 7.3.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| JBoss Developer Studio 11 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
Not affected: 5 products
- Red Hat Fuse 7
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8010
- 2026-10-03 Alias added: GHSA-rc9v-h28f-jcmf
References
Advisory 3
Other 7
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1
- https://github.com/apache/lucene-solr/commit/4ba409e0ff3dc38aad88f7b7ad69a76325272b8
- https://github.com/apache/lucene-solr/commit/6c4e45e28494d4d4d04fb89852d18c86fa3d5f8
- https://github.com/apache/lucene-solr/commit/6d082d5743dee7e08a86b3f2ef03bc025112512
- https://github.com/apache/lucene-solr/commit/96f079b4b47eaadff65c7aaf0e5bafe68e30ec3
- https://issues.apache.org/jira/browse/SOLR-12316
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
More Apache Solr vulnerabilities
- TI-2024-30303 Apache Solr: Authentication bypass possible using a fake URL Path ending CVSS 3.1CRITICAL 9.8
- TI-2019-13101 Injection in Apache Solr KEVCVSS 3.1HIGH 7.5
- TI-2019-00170 Code injection in Apache Solr KEVCVSS 3.1HIGH 7.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-09240 SSRF vulnerability with the Replication handler CVSS 3.1CRITICAL 9.8
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-8010 · CVE Program
- CVE-2018-8010 · NVD
- FIRST EPSS
- GHSA-rc9v-h28f-jcmf · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8010 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences