CVE-2024-45217: Apache Solr Auth Bypass Vulnerability

CVE-2024-45217 Overview

CVE-2024-45217 is an Insecure Default Initialization of Resource vulnerability [CWE-1188] affecting Apache Solr. When a new ConfigSet is created through the Restore command, Solr copies the ConfigSet from a backup and assigns it a new name without setting the trusted metadata flag. ConfigSets missing this flag are treated as trusted implicitly, which allows unauthenticated ConfigSets to load custom code into classloaders. The issue affects Apache Solr from 6.6.0 before 8.11.4 and from 9.0.0 before 9.7.0. Solr instances secured with Authentication and Authorization are not affected.

Critical Impact
Attackers with network access to an unauthenticated Solr instance can create implicitly trusted ConfigSets via the Restore command and load arbitrary code into Solr's classloaders.

Affected Products

Apache Solr 6.6.0 through 8.11.3
Apache Solr 9.0.0 through 9.6.x
Apache Solr deployments without Authentication and Authorization enabled

Discovery Timeline

2024-10-16 - CVE-2024-45217 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45217

Vulnerability Analysis

Apache Solr uses a trusted metadata flag on ConfigSets to determine whether a ConfigSet may load custom code into Java classloaders. Solr sets this flag when the request that uploads the ConfigSet is authenticated and authorized. ConfigSets that lack the flag are treated as trusted by default, inverting the intended security posture.

The Restore command copies an existing ConfigSet from a backup and registers it under a new name. This copy path does not propagate or reset the trusted metadata. As a result, a restored ConfigSet inherits implicit trust regardless of the authentication state of the requester who triggered the restore.

An attacker who can reach the Solr HTTP API on an instance without Authentication and Authorization enabled can call the Restore command against an attacker-supplied backup location. The resulting ConfigSet becomes usable for collection creation and can reference custom classes loaded from the ConfigSet, enabling code execution within the Solr JVM.

Root Cause

The root cause is an insecure default initialization [CWE-1188] in the ConfigSet restore code path. The absence of the trusted flag is interpreted as trusted rather than untrusted, and the restore workflow does not explicitly set the flag based on the authentication context of the caller.

Attack Vector

Exploitation is network-based against the Solr admin API. An attacker issues a Restore request that materializes a ConfigSet from a backup source. Because the restored ConfigSet is treated as trusted, subsequent collection or config actions can load custom code and libraries referenced by that ConfigSet, leading to code execution on the Solr host. See the Apache Solr Security Advisory for the vendor description of the flaw.

Detection Methods for CVE-2024-45217

Indicators of Compromise

Unexpected calls to the Solr RESTORE action against the ConfigSets or Collections API
New ConfigSets present on disk that were not created by authenticated administrators
ConfigSets containing lib directives or custom JAR files not shipped with the deployment
Solr process spawning unexpected child processes or making outbound network connections

Detection Strategies

Audit Solr access logs for action=RESTORE requests and correlate the requester IP with authorized administrator sources
Compare ConfigSet inventories against a known-good baseline and flag ConfigSets missing a trusted:true metadata entry that were created after deployment
Review Solr backup repository configuration for untrusted or attacker-controlled paths

Monitoring Recommendations

Forward Solr request logs and Java process telemetry to a central log platform for retention and search
Alert on Solr JVM loading classes from ConfigSet-derived paths at runtime
Monitor for anomalous outbound connections or shell activity originating from the Solr service account

How to Mitigate CVE-2024-45217

Immediate Actions Required

Upgrade Apache Solr to version 9.7.0 or 8.11.4
Enable Authentication and Authorization on all Solr nodes, including internal deployments
Restrict network access to the Solr admin API to trusted management networks only
Inventory existing ConfigSets and remove any that cannot be attributed to an authorized administrator

Patch Information

Apache Solr 8.11.4 and 9.7.0 fix the restore workflow so that ConfigSets created by the Restore command are assigned the trusted flag based on the authentication context of the request. Refer to the Apache Solr Security Advisory and the Openwall OSS Security Discussion for release details.

Workarounds

Enforce Authentication and Authorization on every Solr endpoint, since instances secured this way are not affected
Restrict the solr.allowPaths and backup repository configuration to controlled directories only
Place Solr behind a reverse proxy that requires authentication and blocks direct access to admin handlers
Disable backup and restore APIs where they are not operationally required

bash

# Configuration example: restrict Solr backup locations and enforce auth
# In solr.in.sh, restrict filesystem paths available to Solr
SOLR_OPTS="$SOLR_OPTS -Dsolr.allowPaths=/var/solr/backups"

# Enable BasicAuth in security.json at the Solr root
# Upload with: bin/solr zk cp security.json zk:/security.json -z <zk_host>