CVE-2024-45217: Apache Solr Insecure Default Initialization of Resource Vulnerability
Summary
CVE-2024-45217: Insecure Default Initialization of Resource vulnerability in Apache Solr. Affects org.apache.solr:solr across 2 version ranges.
>= 6.6.0, < 8.11.4
>= 9.0.0, < 9.7.0
Fixed in 8.11.4 or 9.7.0, depending on the release line you run. How to fix ↓
Also tracked for
- solr · Bitnami
The same CVE-2024-45217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and provides powerful full-text search capabilities, faceted search, and real-time indexing. Solr is widely used for enterprise search applications and is known for its flexibility and extensibility. However, it has a vulnerability related to the creation of ConfigSets that can lead to security risks if not properly managed.
Vulnerability Detail
The vulnerability arises from the creation of new ConfigSets via a Restore command, which copies a configSet from backup without setting the 'trusted' metadata. ConfigSets lacking this flag are implicitly trusted, allowing potentially unverified configurations to be loaded. This can lead to unauthorized code execution since 'trusted' ConfigSets can load custom code into classloaders. The issue affects Apache Solr versions from 6.6.0 before 8.11.4 and from 9.0.0 before 9.7.0, but does not impact instances secured with Authentication/Authorization.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.6.0, < 8.11.48.11.4 -
>= 9.0.0, < 9.7.09.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While upgrading is the best solution, users can mitigate risks by ensuring that their Solr instances are secured with proper Authentication and Authorization mechanisms. This will prevent unauthorized access and the potential exploitation of this vulnerability.
Conclusion
In summary, CVE-2024-45217 is a significant vulnerability in Apache Solr that can lead to unauthorized code execution due to insecure default configurations. Users are strongly advised to upgrade to the latest patched versions and implement robust security measures to protect their instances.
See every vulnerability recorded for org.apache.solr:solr →
FAQ
CVE-2024-45217 is a vulnerability in Apache Solr that allows for insecure default initialization of resource configurations, potentially leading to unauthorized code execution.
The vulnerability affects Apache Solr versions from 6.6.0 before 8.11.4 and from 9.0.0 before 9.7.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, you can check your application's pom.xml for vulnerabilities using the Vulert playground at Vulert Scanner.
If immediate upgrading is not possible, ensure that your Solr instance is secured with Authentication and Authorization to mitigate the risk of exploitation.
Failing to address this vulnerability could allow unauthorized users to execute arbitrary code on your Solr instance, potentially compromising sensitive data and system integrity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr.
