CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
Attackers can bypass authentication in Apache Solr by appending a fake path ending to API URLs, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45216?
CVE-2024-45216 is a critical authentication bypass vulnerability in Apache Solr, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
Which versions are affected by CVE-2024-45216?
5 open source packages ship an affected version, including org.apache.solr:solr and solr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.solr:solr Maven | From 5.3.0 | 8.11.4 |
org.apache.solr:solr Maven | From 5.3.0 | 8.11.4 |
org.apache.solr:solr Maven | From 9.0.0 | 9.7.0 |
org.apache.solr:solr Maven | From 9.0.0 | 9.7.0 |
solr Bitnami | From 5.3.0 | 8.11.4, 9.7.0 |
Products include Apache Solr.
How do I fix CVE-2024-45216?
Upgrade org.apache.solr:solr to a fixed version for your release line: 8.11.4 or 9.7.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-45216 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45216 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Solr
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2021-27905 SSRF vulnerability with the Replication handler
- CVE-2020-13957 Incorrect Authorization in Apache Solr
Sources
Also known as BIT-solr-2024-45216, GHSA-mjvf-4h88-6xm3, UBUNTU-CVE-2024-45216.