CVE-2024-52012
📋 TL;DR
This CVE describes a relative path traversal vulnerability (zipslip) in Apache Solr's configset upload API on Windows systems. Attackers can upload malicious ZIP files containing relative paths to write arbitrary files anywhere on the filesystem. All Apache Solr versions from 6.6 through 9.7.0 running on Windows are affected.
💻 Affected Systems
- Apache Solr
📦 What is this software?
Solr by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file writes leading to remote code execution, data exfiltration, or system destruction.
Likely Case
Unauthorized file writes to sensitive locations, potentially enabling privilege escalation or persistence mechanisms.
If Mitigated
Limited impact with proper access controls, potentially only file writes to non-critical directories.
🎯 Exploit Status
Exploitation requires access to the configset upload API endpoint. ZIP file manipulation is well-understood and tooling exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.8.0
Vendor Advisory: https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd
Restart Required: Yes
Instructions:
1. Download Apache Solr 9.8.0 or later from official sources. 2. Stop the Solr service. 3. Backup configuration and data. 4. Install/upgrade to 9.8.0. 5. Restart Solr service.
🔧 Temporary Workarounds
Restrict Configset Upload API Access
allUse Solr's Rule-Based Authentication Plugin to limit configset upload API to trusted administrators only.
Configure security.json with appropriate authentication rules for /admin/configs endpoint
🧯 If You Can't Patch
- Disable configset upload functionality entirely if not required
- Implement network segmentation and firewall rules to restrict access to Solr admin interfaces
🔍 How to Verify
Check if Vulnerable:
Check Solr version and OS: version must be between 6.6-9.7.0 inclusive AND running on Windows.Check Version:
solr version (from command line) or check Solr admin UIVerify Fix Applied:
Confirm Solr version is 9.8.0 or later, or verify configset upload API is properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual configset upload activity
- File write attempts to unexpected paths
- ZIP file processing errors
Network Indicators:
- POST requests to /solr/admin/configs endpoint with ZIP files
- Unusual admin interface access patterns
SIEM Query:
source="solr.log" AND ("admin/configs" OR "configset upload") AND method=POST