cnvd - cnvd-2024-41664

cnvd-2024-41664

Vulnerability from cnvd

Title: Apache Solr身份验证错误漏洞

Description:

Apache Solr是美国阿帕奇（Apache）基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。

Apache Solr存在身份验证错误漏洞，该漏洞源于存在身份验证不当，攻击者可利用该漏洞使用虚假URL路径结尾绕过身份验证。

Severity: 高

Patch Name: Apache Solr身份验证错误漏洞的补丁

Patch Description:

Apache Solr是美国阿帕奇（Apache）基金会的一款基于Lucene（一款全文搜索引擎）的搜索服务器。该产品支持层面搜索、垂直搜索、高亮显示搜索结果等。

Apache Solr存在身份验证错误漏洞，该漏洞源于存在身份验证不当，攻击者可利用该漏洞使用虚假URL路径结尾绕过身份验证。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45216

Impacted products

Name
Apache Apache Solr

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-45216",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-45216"
    }
  },
  "description": "Apache Solr\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eLucene\uff08\u4e00\u6b3e\u5168\u6587\u641c\u7d22\u5f15\u64ce\uff09\u7684\u641c\u7d22\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u5c42\u9762\u641c\u7d22\u3001\u5782\u76f4\u641c\u7d22\u3001\u9ad8\u4eae\u663e\u793a\u641c\u7d22\u7ed3\u679c\u7b49\u3002\n\nApache Solr\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u865a\u5047URL\u8def\u5f84\u7ed3\u5c3e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-41664",
  "openTime": "2024-10-24",
  "patchDescription": "Apache Solr\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eLucene\uff08\u4e00\u6b3e\u5168\u6587\u641c\u7d22\u5f15\u64ce\uff09\u7684\u641c\u7d22\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u5c42\u9762\u641c\u7d22\u3001\u5782\u76f4\u641c\u7d22\u3001\u9ad8\u4eae\u663e\u793a\u641c\u7d22\u7ed3\u679c\u7b49\u3002\r\n\r\nApache Solr\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u865a\u5047URL\u8def\u5f84\u7ed3\u5c3e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Solr\u8eab\u4efd\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Apache Solr"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-45216",
  "serverity": "\u9ad8",
  "submitTime": "2024-10-23",
  "title": "Apache Solr\u8eab\u4efd\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2024-45216 (GCVE-0-2024-45216)

Vulnerability from cvelistv5

Published

2024-10-16 07:50

Modified

2024-11-08 04:55

Severity ?

CWE

CWE-287 - Improper Authentication

Summary

Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.

References

▼	URL	Tags
	https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending	vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Solr	Version: 5.3.0 ≤ Version: 9.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-16T08:03:35.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/10/15/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "solr",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "8.11.4",
                "status": "affected",
                "version": "5.3.0",
                "versionType": "semver"
              },
              {
                "lessThan": "9.7.0",
                "status": "affected",
                "version": "9.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T04:55:08.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Solr",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "8.11.4",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.7.0",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Liu Huajin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in Apache Solr.\u003c/p\u003eSolr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.\u003cbr\u003eA fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.\u003cbr\u003eThis fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Apache Solr.\n\nSolr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.\nA fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.\nThis fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.\n\n\nThis issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.\n\nUsers are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-16T07:50:25.965Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending"
        }
      ],
      "source": {
        "defect": [
          "SOLR-17417"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Solr: Authentication bypass possible using a fake URL Path ending",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-45216",
    "datePublished": "2024-10-16T07:50:25.965Z",
    "dateReserved": "2024-08-23T17:15:16.710Z",
    "dateUpdated": "2024-11-08T04:55:08.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted