Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Apache-Solr-RCE-via-Velocity-template — Exploit for Apache Solr remote code execution via Velocity template injection, enabling command execution on vulnerable instances through crafted POST requests. | Kitploit
Tools/GitHubGitHub/alewong/apache-solr-rce-via-velocity-template
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubalewong/apache-solr-rce-via-velocity-template

Apache-Solr-RCE-via-Velocity-template

Exploit for Apache Solr remote code execution via Velocity template injection, enabling command execution on vulnerable instances through crafted POST requests.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
35916 years agoReviewed by Kitploit
Share

Apache-Solr-RCE-via-Velocity-template

Reference link

Vulnerability Cause:

  1. When an attacker can directly access the Solr console, they can modify the node's configuration file by sending a POST request similar to /node_name/config.
  2. Apache Solr integrates the VelocityResponseWriter plugin by default. In the plugin's initialization parameters, the option params.resource.loader.enabled controls whether the parameter resource loader is allowed to specify templates in Solr request parameters. The default setting is false. When params.resource.loader.enabled is set to true, users are allowed to specify the loading of related resources by setting request parameters, which means an attacker can execute commands on the server by crafting a malicious attack request.

Vulnerability Reproduction: Recurring vulnerability

Method 1: Manual detection Visit http://x.x.x.x:8983/solr/#/ to enter the main interface, and click Core Selector on the left to view the collection name.

step 1

Use the following two payloads

  1. Modify the collection settings step 2

  • Command execution step 3 Command executed successfully!

    • Method 2: Use script detection

    1. step4
    2. step5

    Vulnerability Fix Suggestions:

    1. It is recommended to ensure that the network settings only allow trusted traffic to communicate with Solr.
    2. Set params.resource.loader.enabled to false, and then set the configuration file to read-only. By default, params.resource.loader.enabled is false, so there is no configuration file. If you need to modify the corresponding value or force a change, you need a configuration file. By default, the node configuration file configoverlay.json has read-write permissions. Configuration file path: (depending on the actual situation) ./example/example-DIH/solr/db/conf/configoverlay.json: ./example/example-DIH/solr/mail/conf/configoverlay.json: ./example/example-DIH/solr/solr/conf/configoverlay.json: Set params.resource.loader.enabled to false in all configoverlay.json files. If there is no configoverlay.json, it is recommended to create one manually and then set its permissions to read-only.

    EXP Description:

    1. Need to search nodes and traverse to identify the nodes that can be POSTed.
    2. Need to determine the operating system version and enter commands to execute operations.
    Download Tool