CVE-2017-7660 Apache Solr insecure inter-node communication
Attackers can spoof cluster nodes to bypass authentication in Apache Solr when BasicAuth is used without specific interceptor plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7660?
CVE-2017-7660 is a high-severity authentication bypass vulnerability in Apache Solr, published on 7 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
Weakness: CWE-287
Which versions are affected by CVE-2017-7660?
4 open source packages ship an affected version, including org.apache.solr:solr-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.solr:solr-core Maven | From 5.3.0 | 5.5.5 |
org.apache.solr:solr-core Maven | From 5.3.0 | 5.5.5 |
org.apache.solr:solr-core Maven | From 6.0.0 | 6.6.0 |
org.apache.solr:solr-core Maven | From 6.0.0 | 6.6.0 |
Products include Apache Solr.
How do I fix CVE-2017-7660?
Upgrade org.apache.solr:solr-core to a fixed version for your release line: 5.5.5 or 6.6.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-7660 being exploited?
There is no known exploitation of CVE-2017-7660 in the wild and no public exploit code.
Other vulnerabilities in Apache Solr
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2021-27905 SSRF vulnerability with the Replication handler
Sources
Also known as GHSA-c82r-qg3w-q5mv.