CVE-2019-0193: Apache Solr DataImportHandler Code Injection Vulnerability
What It Is – The optional DataImportHandler (DIH) module in Apache Solr contains an unauthenticated code‑injection flaw. An attacker can supply crafted data that the DIH evaluates as Java code, leading to remote code execution on the Solr host.
Exploitability – Public proof‑of‑concept code exists; the vulnerability is rated CVSS 3.1 9.8 (Critical). No patch was available until the vendor released an update in 2019.
Affected Products – Apache Solr (any version where the DIH module is enabled).
Why It Matters for Trust & Control Assurance
- Continuous configuration monitoring must flag optional modules like DIH that expand the attack surface.
- Demonstrable patch‑management evidence is a core control for audit readiness under NIST CSF 2.0.
- A defensible log of remediation actions (module disablement, patch application) supports the “secure configuration” control objective that many frameworks map to.
Recommended Actions
- Disable the DataImportHandler if it is not required for your workloads.
- Apply the Apache Solr 7.5.0 or later patch that removes the injection vector.
- Update your asset inventory to record the DIH status and patch level.
- Enable logging of Solr admin actions and monitor for unexpected code execution attempts.
- Map the remediation to your secure‑configuration control and capture evidence in a Trust Center dashboard.
Source: CISA KEV – CVE‑2019‑0193