CVE-2025-24814: Apache Solr Privilege Escalation Flaw

CVE-2025-24814 Overview

CVE-2025-24814 is a privilege escalation vulnerability affecting Apache Solr instances running in standalone or user-managed mode. The vulnerability allows attackers to replace trusted configset files with arbitrary configuration files from elsewhere on the filesystem, potentially enabling malicious code execution through Solr's plugin loading mechanism.

Solr instances are vulnerable when they use the FileSystemConfigSetService component (the default in standalone or user-managed mode) and are running without authentication and authorization. Attackers can exploit this to bypass the trusted configset mechanism, causing Solr to load replacement configuration files that are incorrectly treated as trusted. These malicious config files can leverage <lib> tags to modify Solr's classpath and load malicious code as a searchComponent or other plugin.

Critical Impact

Unauthenticated attackers can achieve privilege escalation and potentially execute arbitrary code by manipulating Solr's configset file loading mechanism to inject malicious plugins.

Affected Products

• Apache Solr versions up through 9.7 (all versions)
• Apache Solr instances using FileSystemConfigSetService (default in standalone mode)
• Apache Solr deployments running without authentication and authorization

Discovery Timeline

• 2025-01-27 - CVE-2025-24814 published to NVD
• 2025-06-25 - Last updated in NVD database

Technical Details for CVE-2025-24814

Vulnerability Analysis

This vulnerability stems from improper access control in Apache Solr's configset file handling mechanism. When Solr operates in standalone or user-managed mode, it relies on the FileSystemConfigSetService component to manage configuration sets. The vulnerability exists because Solr's core creation process can be manipulated to substitute trusted configset files with untrusted alternatives located elsewhere on the filesystem.

The core issue relates to CWE-250 (Execution with Unnecessary Privileges), where the system incorrectly elevates the trust level of replacement configuration files. When an attacker exploits this vulnerability, Solr treats the malicious configuration files as trusted, which unlocks dangerous capabilities including the use of <lib> tags. These tags allow modification of Solr's Java classpath, enabling the loading of arbitrary Java classes that can execute as searchComponents or other Solr plugins.

Root Cause

The root cause is the insufficient validation of configset file origins during core creation in Solr's FileSystemConfigSetService. The component fails to properly verify that configuration files being loaded originate from legitimate trusted configset directories, allowing filesystem path manipulation to substitute malicious files while inheriting trusted status.

Attack Vector

The attack requires network access to a vulnerable Solr instance that lacks authentication and authorization. An attacker can exploit the vulnerability through the following general approach:

1. Identify a Solr instance running in standalone mode without authentication
2. Craft a core creation request that references configuration files outside the intended configset directory
3. Position malicious configuration files on the filesystem (or leverage existing files)
4. The malicious config uses <lib> tags to add attacker-controlled JAR files to Solr's classpath
5. Malicious code executes within the Solr JVM context as a plugin component

The vulnerability does not require user interaction beyond the attacker's network request, though it does require the target system to be misconfigured without proper authentication.

Detection Methods for CVE-2025-24814

Indicators of Compromise

• Unexpected core creation requests in Solr logs, particularly those referencing unusual filesystem paths
• Modification of Solr configset files or appearance of new configuration directories
• Unusual JAR files appearing in Solr's lib directories or classpath locations
• Solr loading unexpected searchComponents or plugins not part of standard deployment

Detection Strategies

• Monitor Solr Admin API access logs for core creation and configuration modification requests
• Implement file integrity monitoring on Solr configuration directories and configset locations
• Alert on any <lib> tag usage in configuration files if not expected in your deployment
• Review Solr startup logs for unexpected classpath additions or plugin loading

Monitoring Recommendations

• Enable comprehensive audit logging for all Solr Admin API operations
• Deploy network monitoring to detect unauthorized access to Solr management endpoints
• Implement anomaly detection for Solr process behavior, including new library loading
• Regularly audit Solr configuration files for unauthorized <lib> tag additions

How to Mitigate CVE-2025-24814

Immediate Actions Required

• Enable authentication and authorization on all Solr clusters immediately
• Review and restrict network access to Solr Admin API endpoints
• Audit existing Solr deployments for signs of exploitation
• Consider migrating from standalone mode to SolrCloud architecture

Patch Information

Apache has released Solr version 9.8.0 which mitigates this vulnerability by disabling the use of <lib> tags by default. Users should upgrade to Solr 9.8.0 or later to receive this fix. For detailed patch information, refer to the Apache Mailing List Thread.

Additional security advisories are available from NetApp Security Advisory and Openwall OSS Security.

Workarounds

• Enable Solr's built-in authentication and authorization mechanisms to prevent unauthorized access
• Switch from FileSystemConfigSetService to SolrCloud mode which uses a different configset management approach
• Implement network segmentation to restrict access to Solr instances from untrusted networks
• Remove or restrict write access to filesystem locations that could be used for malicious configuration placement

# Enable Basic Authentication in Solr (example configuration)
# Add to solr.in.sh or solr.in.cmd
SOLR_AUTH_TYPE="basic"
SOLR_AUTHENTICATION_OPTS="-Dbasicauth=solr:SolrRocks"

# Alternatively, configure security.json for Solr authentication
# Place in $SOLR_HOME/security.json or upload to ZooKeeper for SolrCloud