Loading vulnerability…
CVE-2019-0192 is a remote code execution vulnerability in Apache Solr affecting versions 5.0.0 through 5.5.5 and 6.0.0 through 6.6.5. The issue arises because Solr's Config API permits JMX server configuration through an HTTP POST request. An attacker able to invoke this functionality can direct Solr to connect to a malicious RMI server, where unsafe deserialization on the Solr side can be triggered. Successful exploitation results in attacker-controlled code execution within the Solr process context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept exploit for CVE-2019-0192, a remote code execution vulnerability in Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5. The exploit leverages Solr's ConfigAPI to configure a JMX server via HTTP POST, pointing it to a malicious RMI server (set up using ysoserial with the Jdk7u21 payload). The Python script (CVE-2019-0192.py) automates the exploitation process: it checks for available Solr cores, constructs the appropriate configuration endpoint, and repeatedly triggers the vulnerability by sending crafted JSON payloads to the Solr server. The exploit stages a series of file operations on the target, ultimately allowing the attacker to execute arbitrary shell commands. The script requires the attacker to run a malicious RMI server and interactively provides a shell-like interface for command execution. The included README.md provides background, usage instructions, and references to the vulnerability and Solr documentation. The main attack vector is network-based, targeting the Solr HTTP API and leveraging RMI for code execution. Key fingerprintable endpoints include the Solr admin/config URLs, the RMI service URL, and temporary files used during exploitation.
This repository contains a Python exploit script (solr_RCE.py) targeting Apache Solr servers vulnerable to CVE-2019-0192, a remote code execution flaw via the DataImportHandler. The exploit works by first enumerating available Solr cores using the /solr/admin/cores endpoint, then sending a specially crafted POST request to the /solr/<core>/dataimport endpoint. The payload injects JavaScript into the dataConfig parameter, which is executed by the vulnerable Solr instance, allowing arbitrary system commands to be run on the server. The script is interactive, prompting the user for the target Solr URL and the command to execute. The README provides a brief overview and usage instructions. The exploit requires the DataImportHandler to be enabled on the target, which is not the default configuration. The repository is straightforward, with one exploit script and a README, and is operational in maturity, providing a working remote code execution capability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.