PT-2024-7449 · Apache · Apache Solr

Liu Huajin · Published 2024-08-23 · Updated 2025-07-01 · CVE-2024-45216

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 5.3.0 through 8.11.3 Apache Solr versions 9.0.0 through 9.6.9

Description: The issue is related to an improper authentication vulnerability in Apache Solr, where Solr instances using the PKIAuthenticationPlugin are vulnerable to authentication bypass. A fake ending at the end of any Solr API URL path can allow requests to skip authentication while maintaining the API contract with the original URL path. This fake ending looks like an unprotected API path but is stripped off internally after authentication but before API routing. Over 45,000 services are potentially affected by this issue.

Recommendations: To resolve the issue, upgrade Apache Solr to version 8.11.4 or 9.7.0, which fix the issue. As a temporary workaround, consider restricting access to Solr API endpoints to minimize the risk of exploitation.

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2024-08828

BIT-SOLR-2024-45216

CVE-2024-45216

GHSA-MJVF-4H88-6XM3

Affected Products

Apache Solr

References · 40

• https://osv.dev/vulnerability/BIT-solr-2024-45216 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45216 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45216 · Security Note
• https://osv.dev/vulnerability/GHSA-mjvf-4h88-6xm3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45216 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45216 · Vendor Advisory
• https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08828 · Security Note
• https://twitter.com/the_yellow_fall/status/1846744891054870941 · Twitter Post
• https://twitter.com/DhiyaneshDK/status/1852317524278280364 · Twitter Post
• https://twitter.com/CCBalert/status/1846970458727428162 · Twitter Post
• https://twitter.com/Netlas_io/status/1846862771956101293 · Twitter Post
• https://twitter.com/darkwebinsight/status/1846949261264802225 · Twitter Post
• https://twitter.com/Netlas_io/status/1846862948855111931 · Twitter Post