Multiple vulnerabilities in Apache Solr

Published: 2025-01-27

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-52012 CVE-2025-24814
CWE-ID	CWE-22 CWE-264
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Apache Solr Client/Desktop applications / Other client software
Vendor	Apache Foundation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU103325

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-52012

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when handling ZIP files passed via "configset upload" API. A remote user can upload a specially crafted ZIP archive and overwrite arbitrary files on the system (a.k.a. zipslip attack).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Apache Solr: 6.6 - 9.7.0

CPE2.3

External links

https://www.openwall.com/lists/oss-security/2025/01/26/2
https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU103324

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-24814

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error when handling configuration files. Solr instances that use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.

Mitigation

Install updates from vendor's website.