CVE-2024-52012: Apache Solr Path Traversal Vulnerability

CVE-2024-52012 Overview

CVE-2024-52012 is a Relative Path Traversal vulnerability affecting Apache Solr installations running on Windows systems. The vulnerability exists in the "configset upload" API, which fails to properly sanitize input when processing ZIP file uploads. This flaw enables attackers to craft malicious ZIP files containing relative file paths that can write data to arbitrary locations on the filesystem—a technique commonly known as "zipslip."

The vulnerability allows authenticated attackers with access to the configset upload API to potentially overwrite critical system files or plant malicious content in sensitive directories, which could lead to further compromise of the affected system.

Critical Impact
Authenticated attackers can exploit this zipslip vulnerability to write arbitrary files to unintended locations on Windows-based Solr servers, potentially leading to system compromise or data manipulation.

Affected Products

Apache Solr versions 6.6 through 9.7.0
Windows-based Solr deployments are specifically vulnerable
Solr instances with unrestricted access to the configset upload API

Discovery Timeline

2025-01-27 - CVE CVE-2024-52012 published to NVD
2025-06-27 - Last updated in NVD database

Technical Details for CVE-2024-52012

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal) and specifically affects the configset upload functionality in Apache Solr. The core issue stems from insufficient validation of file paths contained within uploaded ZIP archives. When a ZIP file is processed, the extraction routine does not adequately sanitize the file paths, allowing entries with relative path components (such as ../) to escape the intended extraction directory.

The attack requires network access and authenticated privileges to the configset upload API. On successful exploitation, an attacker can write files with arbitrary content to locations outside the designated Solr configuration directories. This can result in confidentiality and integrity impacts, though availability is not directly affected.

Root Cause

The root cause is improper input validation in Apache Solr's ZIP file extraction logic within the configset upload API. When processing uploaded configuration sets, the code fails to normalize and validate file paths extracted from the ZIP archive before writing them to disk. Specifically, the implementation does not strip or reject directory traversal sequences (e.g., ../ or ..\ on Windows), allowing malicious ZIP entries to reference paths outside the intended target directory.

Attack Vector

The attack is conducted over the network and targets the configset upload API endpoint. An attacker must have authenticated access to this API, which is typically available to administrators or users with elevated privileges. The attack flow involves:

Crafting a malicious ZIP file containing entries with relative path traversal sequences
Uploading this ZIP file through the configset upload API
Upon extraction, files are written to arbitrary filesystem locations dictated by the malicious paths

The vulnerability mechanism involves creating ZIP archive entries with filenames like ../../sensitive/path/malicious.file. When extracted without proper path validation, the file is written outside the expected configuration directory, potentially overwriting system files or planting malicious content.

For technical details on this zipslip attack pattern, see the Apache Mailing List Thread and the OpenWall OSS Security Update.

Detection Methods for CVE-2024-52012

Indicators of Compromise

Unexpected files appearing in directories outside of Solr's configuration paths, particularly system directories
Unusual configset upload requests in Solr access logs, especially containing suspicious archive filenames
File modification timestamps on critical system files that do not align with expected administrative activities
Evidence of ZIP file uploads containing entries with ../ or ..\ path components

Detection Strategies

Monitor Solr access logs for requests to the /solr/admin/configs or configset upload endpoints, especially from unexpected sources
Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications
Deploy network traffic analysis to identify suspicious ZIP file uploads to Solr instances
Configure SIEM rules to alert on configset upload activities from non-administrative IP addresses or accounts

Monitoring Recommendations

Enable detailed audit logging for all administrative API calls in Apache Solr
Establish baseline behavior for configset uploads and alert on deviations such as unusual upload frequency or size
Monitor filesystem changes in directories outside Solr's expected configuration paths on Windows servers
Review and correlate authentication logs with configset upload activities to identify potential abuse

How to Mitigate CVE-2024-52012

Immediate Actions Required

Upgrade Apache Solr to version 9.8.0 or later, which contains the fix for this vulnerability
If immediate upgrade is not possible, implement Solr's "Rule-Based Authentication Plugin" to restrict configset upload API access to trusted administrators only
Audit existing access controls to ensure the configset upload API is not publicly accessible
Review recent configset upload logs for any suspicious activity that may indicate exploitation attempts

Patch Information

Apache has released version 9.8.0 which addresses this path traversal vulnerability. Users running affected versions (6.6 through 9.7.0) should upgrade as soon as possible. The official advisory is available on the Apache Mailing List Thread.

Workarounds

Configure Solr's Rule-Based Authentication Plugin to restrict the configset upload API to a trusted set of administrators
Implement network-level access controls (firewall rules, network segmentation) to limit access to Solr administrative endpoints
Consider deploying a Web Application Firewall (WAF) with rules to inspect and block ZIP uploads containing path traversal sequences
Run Solr on Linux where this specific vulnerability does not apply, if Windows deployment is not required

bash

# Example: Restricting access using Rule-Based Authentication Plugin
# Add to security.json to limit configset upload access

# Create or update security.json with authorization rules
curl -X POST -H 'Content-type:application/json' --data-binary '{
  "set-permission": {
    "name": "config-edit",
    "role": "admin",
    "path": "/admin/configs/*"
  }
}' http://localhost:8983/solr/admin/authorization