CVE-2024-52012: Apache Solr Path Traversal Vulnerability

CVE-2024-52012 Overview

CVE-2024-52012 is a Relative Path Traversal vulnerability affecting Apache Solr installations running on Windows systems. The vulnerability exists in the "configset upload" API, which fails to properly sanitize input when processing ZIP file uploads. This flaw enables attackers to craft malicious ZIP files containing relative file paths that can write data to arbitrary locations on the filesystem—a technique commonly known as "zipslip."

The vulnerability allows authenticated attackers with access to the configset upload API to potentially overwrite critical system files or plant malicious content in sensitive directories, which could lead to further compromise of the affected system.

Critical Impact

Authenticated attackers can exploit this zipslip vulnerability to write arbitrary files to unintended locations on Windows-based Solr servers, potentially leading to system compromise or data manipulation.

Affected Products

• Apache Solr versions 6.6 through 9.7.0
• Windows-based Solr deployments are specifically vulnerable
• Solr instances with unrestricted access to the configset upload API

Discovery Timeline

• 2025-01-27 - CVE CVE-2024-52012 published to NVD
• 2025-06-27 - Last updated in NVD database

Technical Details for CVE-2024-52012

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal) and specifically affects the configset upload functionality in Apache Solr. The core issue stems from insufficient validation of file paths contained within uploaded ZIP archives. When a ZIP file is processed, the extraction routine does not adequately sanitize the file paths, allowing entries with relative path components (such as ../) to escape the intended extraction directory.

The attack requires network access and authenticated privileges to the configset upload API. On successful exploitation, an attacker can write files with arbitrary content to locations outside the designated Solr configuration directories. This can result in confidentiality and integrity impacts, though availability is not directly affected.

Root Cause

The root cause is improper input validation in Apache Solr's ZIP file extraction logic within the configset upload API. When processing uploaded configuration sets, the code fails to normalize and validate file paths extracted from the ZIP archive before writing them to disk. Specifically, the implementation does not strip or reject directory traversal sequences (e.g., ../ or ..\ on Windows), allowing malicious ZIP entries to reference paths outside the intended target directory.

Attack Vector

The attack is conducted over the network and targets the configset upload API endpoint. An attacker must have authenticated access to this API, which is typically available to administrators or users with elevated privileges. The attack flow involves:

1. Crafting a malicious ZIP file containing entries with relative path traversal sequences
2. Uploading this ZIP file through the configset upload API
3. Upon extraction, files are written to arbitrary filesystem locations dictated by the malicious paths

The vulnerability mechanism involves creating ZIP archive entries with filenames like ../../sensitive/path/malicious.file. When extracted without proper path validation, the file is written outside the expected configuration directory, potentially overwriting system files or planting malicious content.

For technical details on this zipslip attack pattern, see the Apache Mailing List Thread and the OpenWall OSS Security Update.

Detection Methods for CVE-2024-52012

Indicators of Compromise

• Unexpected files appearing in directories outside of Solr's configuration paths, particularly system directories
• Unusual configset upload requests in Solr access logs, especially containing suspicious archive filenames
• File modification timestamps on critical system files that do not align with expected administrative activities
• Evidence of ZIP file uploads containing entries with ../ or ..\ path components

Detection Strategies

• Monitor Solr access logs for requests to the /solr/admin/configs or configset upload endpoints, especially from unexpected sources
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications
• Deploy network traffic analysis to identify suspicious ZIP file uploads to Solr instances
• Configure SIEM rules to alert on configset upload activities from non-administrative IP addresses or accounts

Monitoring Recommendations

• Enable detailed audit logging for all administrative API calls in Apache Solr
• Establish baseline behavior for configset uploads and alert on deviations such as unusual upload frequency or size
• Monitor filesystem changes in directories outside Solr's expected configuration paths on Windows servers
• Review and correlate authentication logs with configset upload activities to identify potential abuse

How to Mitigate CVE-2024-52012

Immediate Actions Required

• Upgrade Apache Solr to version 9.8.0 or later, which contains the fix for this vulnerability
• If immediate upgrade is not possible, implement Solr's "Rule-Based Authentication Plugin" to restrict configset upload API access to trusted administrators only
• Audit existing access controls to ensure the configset upload API is not publicly accessible
• Review recent configset upload logs for any suspicious activity that may indicate exploitation attempts

Patch Information

Apache has released version 9.8.0 which addresses this path traversal vulnerability. Users running affected versions (6.6 through 9.7.0) should upgrade as soon as possible. The official advisory is available on the Apache Mailing List Thread.

Workarounds

• Configure Solr's Rule-Based Authentication Plugin to restrict the configset upload API to a trusted set of administrators
• Implement network-level access controls (firewall rules, network segmentation) to limit access to Solr administrative endpoints
• Consider deploying a Web Application Firewall (WAF) with rules to inspect and block ZIP uploads containing path traversal sequences
• Run Solr on Linux where this specific vulnerability does not apply, if Windows deployment is not required

# Example: Restricting access using Rule-Based Authentication Plugin
# Add to security.json to limit configset upload access

# Create or update security.json with authorization rules
curl -X POST -H 'Content-type:application/json' --data-binary '{
  "set-permission": {
    "name": "config-edit",
    "role": "admin",
    "path": "/admin/configs/*"
  }
}' http://localhost:8983/solr/admin/authorization