CVE-2024-45216criticalobserved exploitationCWE-287CWE-863

CVE-2024-45216: critical vulnerability in Apache Solr

Apache Solr: Authentication bypass possible using a fake URL Path ending

Published · Updated

Follow this CVE+ Monitor Apache Solr+ Monitor org.apache.solr:solr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 93%
from disclosure to weapon47 days
Published on NVDOct 16
1st PoC+47d
VulnCheck+380d
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Solr
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Solr

In the same product, most dangerous first.

CVE-2021-27905—SSRF vulnerability with the Replication handlerEPSS 93.1%CVE-2023-50386HIGHApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsEPSS 83.7%CVE-2019-0192—CVE-2019-0192EPSS 78.2%CVE-2023-50290MEDIUMApache Solr: Host environment variables are published via the Metrics APIEPSS 68.4%CVE-2024-52012MEDIUMApache Solr: Configset upload on Windows allows arbitrary path write-accessEPSS 47.1%CVE-2018-1308—CVE-2018-1308EPSS 20.8%