CVE-2019-0193 – CVE-2019-0193 is a remote code execution vulner... (How to Fix)

Q: What is the severity of CVE-2019-0193?

CVE-2019-0193 has a CVSS score of 7.2 (HIGH). CVE-2019-0193 is a remote code execution vulnerability in Apache Solr's DataImportHandler module. Attackers can exploit the debug mode's 'dataConfig' parameter to execute arbitrary scripts, potentially compromising the entire server. This affects Apache Solr installations with DataImportHandler enabled, particularly those exposed to untrusted networks.

📋 TL;DR

CVE-2019-0193 is a remote code execution vulnerability in Apache Solr's DataImportHandler module. Attackers can exploit the debug mode's 'dataConfig' parameter to execute arbitrary scripts, potentially compromising the entire server. This affects Apache Solr installations with DataImportHandler enabled, particularly those exposed to untrusted networks.

💻 Affected Systems

Products:

Apache Solr

Versions: All versions before 8.2.0

Operating Systems: All operating systems running Apache Solr

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with DataImportHandler module enabled, but this is a popular optional module.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise allowing arbitrary code execution, data theft, lateral movement, and complete system takeover.

🟠

Likely Case

Remote code execution leading to data exfiltration, installation of backdoors, or cryptomining malware.

🟢

If Mitigated

No impact if the vulnerable parameter is disabled or proper access controls prevent exploitation.

🌐 Internet-Facing: HIGH - Directly exploitable via HTTP requests without authentication in default configurations.

🏢 Internal Only: MEDIUM - Still exploitable by internal attackers or through compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation is straightforward via crafted HTTP requests to the DataImportHandler debug endpoint.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 8.2.0 and later

Vendor Advisory: https://issues.apache.org/jira/browse/SOLR-13669

Restart Required: Yes

Instructions:

1. Upgrade Apache Solr to version 8.2.0 or later. 2. Restart Solr service. 3. Verify the 'enable.dih.dataConfigParam' system property is not set to true unless specifically required.

🔧 Temporary Workarounds

Disable DataImportHandler parameter

all

Prevent use of the vulnerable dataConfig parameter by ensuring the Java system property 'enable.dih.dataConfigParam' is not set to true.

Ensure '-Denable.dih.dataConfigParam=false' or remove this property from Solr startup parameters

Disable DataImportHandler module

all

Remove or disable the DataImportHandler module if not required.

Remove DataImportHandler from solrconfig.xml or disable via configuration

🧯 If You Can't Patch

Implement strict network access controls to limit Solr admin interface access to trusted IPs only.
Use web application firewalls (WAF) to block requests containing suspicious dataConfig parameters.

🔍 How to Verify

Check if Vulnerable:

Check if Solr version is below 8.2.0 and DataImportHandler is enabled in solrconfig.xml.

Check Version:

Check Solr admin UI or run: java -jar start.jar --version

Verify Fix Applied:

Verify Solr version is 8.2.0 or higher and ensure 'enable.dih.dataConfigParam' is not set to true in Java system properties.

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /solr/corename/dataimport with dataConfig parameter
Unusual script execution or system commands in Solr logs

Network Indicators:

POST requests to DataImportHandler endpoints with XML/script content
Unusual outbound connections from Solr server

SIEM Query:

source="solr.log" AND "dataimport" AND "dataConfig"

📊 Metadata

CVE ID: CVE-2019-0193

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: August 1, 2019

Last Updated: October 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-0193, you might also want to check these: