Apache Solr: Authentication bypass possible using a fake URL Path ending

Vulnerability

Details

CVE-2024-45216 is an improper authentication vulnerability in Apache Solr's PKIAuthenticationPlugin, which is enabled by default when Solr authentication is configured [1][3]. The plugin incorrectly handles URL paths: appending a fake ending (e.g., :/admin/info/key) to any Solr API URL allows requests to skip authentication while maintaining the original API contract. The fake ending is stripped internally after authentication but before API routing, bypassing access controls [2][4].

Exploitation

An attacker can exploit this by crafting a request to a protected API endpoint and appending the special fake path ending. No authentication credentials are required to access the API, as the PKIAuthenticationPlugin fails to validate the request properly. The attack is performed over HTTP, and no special network position is needed if the Solr instance is exposed [2][4].

Impact

Successful exploitation allows an unauthenticated attacker to access any Solr API endpoint that is normally protected by authentication. This could lead to information disclosure, including sensitive configuration details (e.g., using /admin/info/properties or /admin/info/key), and potentially further compromise of the Solr instance [4]. The CVSS 4.0 severity rating is critical (9.3), reflecting the ease of exploitation and potential impact [1].

Mitigation

Apache Solr has released fixed versions 8.11.4 and 9.7.0, which correct the URL path handling in PKIAuthenticationPlugin [1][3]. Users are strongly recommended to upgrade immediately. There are no known workarounds; the only mitigation is to apply the patch or upgrade to a non-vulnerable version [2].