Improper Authentication vulnerability in Apache Solr

The impact of CVE-2024-45216 is severe. Successful exploitation allows an attacker to bypass authentication and access sensitive data or perform unauthorized actions within the Solr environment. This could include reading or modifying data, executing arbitrary commands (depending on Solr configuration and permissions), and potentially gaining control of the entire system. The vulnerability's ease of exploitation, combined with the widespread use of Solr, makes it a high-priority risk. The fake ending technique is relatively simple to implement, requiring only the ability to craft HTTP requests. This bypass effectively renders authentication mechanisms useless, exposing the underlying Solr infrastructure to significant risk.

Organizations heavily reliant on Apache Solr for search functionality, particularly those using the default PKIAuthenticationPlugin configuration, are at significant risk. Shared hosting environments where multiple users share a Solr instance are also particularly vulnerable, as an attacker compromising one user's account could potentially exploit this vulnerability to gain access to other users’ data. Legacy Solr deployments running older, unpatched versions are especially susceptible.

• linux / server:

journalctl -u solr | grep -i "authentication bypass"

• generic web:

curl -I 'http://solr_server/solr/core_name/query?q=*:*&fake_ending' | grep 'WWW-Authenticate'

• linux / server:

ps aux | grep -i pkiauthenticationplugin

1. 2024-10-16Disclosure

   disclosure

2. 2024-10-16Patch

   patch

1. Gereserveerd2024-08-23
2. Gepubliceerd2024-10-16
3. Gewijzigd2025-07-02
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-45216 is to upgrade to a patched version of Apache Solr. Upgrade to version 9.7.0 or 8.11.4 as soon as possible. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While a direct WAF rule to block requests with unusual URL endings is possible, it may lead to false positives and disrupt legitimate traffic. Carefully review Solr authentication configurations and restrict access to sensitive APIs. Monitor Solr logs for suspicious activity, specifically looking for requests with unexpected URL paths. After upgrading, confirm the fix by attempting to access protected Solr APIs with a modified URL path containing a fake ending; authentication should be enforced.