CVE-2020-13957 – This vulnerability in Apache Solr allows attack... (How to Fix)

Q: What is the severity of CVE-2020-13957?

CVE-2020-13957 has a CVSS score of 9.8 (CRITICAL). This vulnerability in Apache Solr allows attackers to bypass security controls and upload malicious ConfigSets via API without authentication. By combining UPLOAD and CREATE actions, attackers can enable dangerous features that could lead to remote code execution. Affects Apache Solr versions 6.6.0-6.6.6, 7.0.0-7.7.3, and 8.0.0-8.6.2.

📋 TL;DR

This vulnerability in Apache Solr allows attackers to bypass security controls and upload malicious ConfigSets via API without authentication. By combining UPLOAD and CREATE actions, attackers can enable dangerous features that could lead to remote code execution. Affects Apache Solr versions 6.6.0-6.6.6, 7.0.0-7.7.3, and 8.0.0-8.6.2.

💻 Affected Systems

Products:

Apache Solr

Versions: 6.6.0 to 6.6.6, 7.0.0 to 7.7.3, 8.0.0 to 8.6.2

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerable when Solr API is accessible without proper authentication. Cloud deployments and standalone instances are both affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with full system compromise, allowing attackers to execute arbitrary commands, steal data, or deploy ransomware.

🟠

Likely Case

Unauthenticated attackers gaining remote code execution on vulnerable Solr instances, potentially leading to data exfiltration or lateral movement.

🟢

If Mitigated

Attackers blocked by proper authentication/authorization controls, network segmentation, or security monitoring.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires API access but no authentication. Multiple public references and advisories exist.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.6.7, 7.7.4, 8.6.3

Vendor Advisory: https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a9a0b2362f6adfa573%40%3Cissues.lucene.apache.org%3E

Restart Required: Yes

Instructions:

1. Download patched version from Apache Solr website. 2. Backup current configuration and data. 3. Stop Solr service. 4. Replace Solr installation with patched version. 5. Restore configuration and data. 6. Start Solr service. 7. Verify version and functionality.

🔧 Temporary Workarounds

Enable Authentication

all

Configure Solr to require authentication for API access, preventing unauthenticated exploitation.

Configure authentication in solr.in.sh or solr.in.cmd: SOLR_AUTH_TYPE="basic"
SOLR_AUTHENTICATION_OPTS="-Dbasicauth=username:password"

Network Access Control

linux

Restrict network access to Solr API endpoints using firewall rules.

iptables -A INPUT -p tcp --dport 8983 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 8983 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to isolate Solr instances from untrusted networks
Deploy web application firewall (WAF) rules to block malicious API requests

🔍 How to Verify

Check if Vulnerable:

Check Solr version via admin UI or API: http://solr-host:8983/solr/admin/info/system

Check Version:

curl http://solr-host:8983/solr/admin/info/system | grep "solr-spec-version"

Verify Fix Applied:

Verify version is 6.6.7+, 7.7.4+, or 8.6.3+ and test API authentication requirements

📡 Detection & Monitoring

Log Indicators:

Unauthenticated ConfigSet upload attempts
UPLOAD/CREATE API calls from unexpected sources
Error logs related to security bypass

Network Indicators:

Unusual API traffic patterns to ConfigSet endpoints
Multiple rapid UPLOAD/CREATE requests

SIEM Query:

source="solr.log" AND ("UPLOAD" OR "CREATE") AND NOT user="authenticated_user"

📊 Metadata

CVE ID: CVE-2020-13957

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-863

Published: October 13, 2020

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-13957, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Solr by Apache

Solr by Apache

Solr by Apache

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Enable Authentication

Network Access Control

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities