CVE-2021-29943
📋 TL;DR
This vulnerability in Apache Solr's ConfigurableInternodeAuthHadoopPlugin causes distributed requests to be forwarded using server credentials instead of client credentials, leading to incorrect authorization decisions. Attackers could exploit this to bypass intended access controls and potentially access unauthorized data. Organizations using affected Solr versions with this authentication plugin enabled are at risk.
💻 Affected Systems
- Apache Solr
📦 What is this software?
Solr by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to sensitive indexed data, potentially leading to data exfiltration or manipulation of search results.
Likely Case
Privilege escalation where users can access data beyond their authorized permissions, violating data segregation policies.
If Mitigated
Limited impact if proper network segmentation and additional authentication layers are in place, though authorization bypass remains possible.
🎯 Exploit Status
Exploitation requires access to a Solr instance with the vulnerable plugin enabled. The vulnerability is in the authentication flow logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Solr 8.8.2 and later
Vendor Advisory: https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
Restart Required: Yes
Instructions:
1. Download Apache Solr 8.8.2 or later from the official Apache website. 2. Backup your current Solr configuration and data. 3. Stop the Solr service. 4. Replace the Solr installation with the patched version. 5. Restore your configuration and data. 6. Start the Solr service.
🔧 Temporary Workarounds
Disable ConfigurableInternodeAuthHadoopPlugin
allRemove or disable the vulnerable authentication plugin if not required for your deployment.
Edit solrconfig.xml and remove or comment out ConfigurableInternodeAuthHadoopPlugin configuration
Restart Solr service
Network Segmentation
allIsolate Solr clusters to prevent unauthorized network access to distributed nodes.
Configure firewall rules to restrict Solr node communication to authorized hosts only
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with Solr nodes
- Enable additional authentication/authorization layers and audit all access to Solr
🔍 How to Verify
Check if Vulnerable:
Check if ConfigurableInternodeAuthHadoopPlugin is configured in solrconfig.xml and verify Solr version is below 8.8.2.Check Version:
curl http://solr-host:8983/solr/admin/info/system | grep -o '"solr-spec-version":"[^"]*"'Verify Fix Applied:
Confirm Solr version is 8.8.2 or higher and verify the plugin configuration if still in use.📡 Detection & Monitoring
Log Indicators:
- Unexpected authorization failures or successes in Solr audit logs
- Authentication events showing server credentials being used for client requests
Network Indicators:
- Unusual patterns in distributed Solr node communications
- Requests bypassing expected authentication flows
SIEM Query:
source="solr.log" AND ("authorization failure" OR "authentication bypass" OR "ConfigurableInternodeAuthHadoopPlugin")🔗 References
- https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210604-0009/
- https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210604-0009/
