CVE-2024-45216: Apache Solr Auth Bypass Vulnerability

CVE-2024-45216 Overview

CVE-2024-45216 is a critical authentication bypass vulnerability affecting Apache Solr instances that use the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is configured. This vulnerability allows attackers to completely bypass authentication by appending a fake URL path ending to any Solr API request. The fake ending mimics an unprotected API path, causing the authentication layer to skip verification, while internally the fake path segment is stripped before API routing occurs—maintaining the original API contract.

Critical Impact

Unauthenticated remote attackers can bypass authentication entirely and gain full access to protected Solr API endpoints, potentially leading to unauthorized data access, modification, or complete system compromise.

Affected Products

• Apache Solr versions 5.3.0 through 8.11.3
• Apache Solr versions 9.0.0 through 9.6.x
• Any Solr deployment using PKIAuthenticationPlugin (enabled by default with Solr Authentication)

Discovery Timeline

• October 16, 2024 - CVE-2024-45216 published to NVD
• July 1, 2025 - Last updated in NVD database

Technical Details for CVE-2024-45216

Vulnerability Analysis

This authentication bypass vulnerability exists in Apache Solr's request handling pipeline when PKIAuthenticationPlugin is active. The core issue stems from a mismatch between how the authentication layer and the API routing layer process URL paths. An attacker can craft a malicious URL by appending a specially formatted fake path ending that appears to match an unprotected endpoint pattern. The authentication layer incorrectly identifies this path as exempt from authentication requirements and allows the request to proceed. However, after the authentication check completes, the internal request processing strips the fake path ending before routing occurs, causing the request to be directed to the originally intended protected API endpoint.

This architectural flaw enables complete authentication bypass without any credentials, affecting all API operations on vulnerable Solr instances. The network-accessible nature of most Solr deployments combined with the lack of required user interaction makes this vulnerability particularly dangerous for internet-facing installations.

Root Cause

The root cause is an improper authentication implementation (CWE-287) combined with incorrect authorization handling (CWE-863) in Apache Solr's request processing pipeline. The vulnerability arises from inconsistent URL path parsing between the authentication verification phase and the subsequent API routing phase. The PKIAuthenticationPlugin evaluates the complete URL path including the fake ending to determine authentication requirements, while the internal routing logic strips the fake path segment before dispatching the request—creating a security bypass condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to a vulnerable Solr instance can exploit this vulnerability by:

1. Identifying a protected Solr API endpoint that requires authentication
2. Appending a fake URL path ending that matches the pattern of an unprotected resource
3. Sending the crafted request to the Solr instance
4. The authentication layer incorrectly permits the request based on the fake path ending
5. The internal routing strips the fake ending and processes the request against the protected endpoint
6. The attacker receives a response from the protected API as if properly authenticated

The vulnerability mechanism involves URL path manipulation where a crafted suffix is appended to legitimate API paths. The fake ending resembles an unprotected API resource path, causing the PKIAuthenticationPlugin to skip authentication verification. After authentication passes, the internal request processing normalizes the URL by removing the fake suffix, routing the request to the originally intended protected endpoint. For technical details on the specific path patterns involved, see the Apache Solr Security Advisory.

Detection Methods for CVE-2024-45216

Indicators of Compromise

• Unusual URL patterns in Solr access logs containing unexpected path suffixes or extensions
• API requests to administrative endpoints from unauthenticated sources
• Successful responses to Solr API requests that should require authentication
• Anomalous query patterns or data access from unrecognized IP addresses

Detection Strategies

• Monitor Solr access logs for URL paths containing suspicious endings or patterns that don't match expected API structures
• Implement web application firewall (WAF) rules to detect and block requests with anomalous URL path patterns
• Review authentication logs for gaps where API access occurred without corresponding successful authentication events
• Deploy network intrusion detection signatures that identify requests with malformed or manipulated URL paths targeting Solr endpoints

Monitoring Recommendations

• Enable detailed access logging on all Solr instances to capture full request URLs and response codes
• Implement real-time alerting for any unauthenticated access to sensitive Solr administrative APIs
• Monitor for reconnaissance activity such as path enumeration or fuzzing attempts against Solr endpoints
• Track changes to Solr collections, configurations, or data that occur outside normal operational windows

How to Mitigate CVE-2024-45216

Immediate Actions Required

• Upgrade Apache Solr to version 9.7.0 or 8.11.4 immediately as these versions contain the security fix
• If immediate patching is not possible, restrict network access to Solr instances using firewall rules
• Place Solr behind a reverse proxy with additional authentication controls as a defense-in-depth measure
• Audit access logs for evidence of exploitation attempts or unauthorized access

Patch Information

Apache has released patched versions that address this authentication bypass vulnerability. Users running affected versions should upgrade to:

• Apache Solr 9.7.0 for users on the 9.x branch
• Apache Solr 8.11.4 for users on the 8.x branch

The patch corrects the URL path parsing inconsistency between the authentication and routing layers, ensuring that fake path endings cannot be used to bypass authentication. Refer to the Apache Solr Security Advisory for complete upgrade instructions and additional details.

Workarounds

• Implement network-level access controls to restrict Solr access to trusted IP addresses only
• Deploy a reverse proxy with strict URL validation that rejects requests with unexpected path patterns
• Temporarily disable public network access to Solr instances until patches can be applied
• Enable additional authentication mechanisms at the network layer (VPN, mTLS) as a compensating control

# Example: Restrict Solr access using iptables
# Allow only trusted network ranges to access Solr on port 8983
iptables -A INPUT -p tcp --dport 8983 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8983 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8983 -j DROP