CVE-2024-45217

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://solr.apache.org/security.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly
http://www.openwall.com/lists/oss-security/2024/10/15/9

Configurations

No configuration.

History

No history.

Information

Published : 2024-10-16 08:15

Updated : 2024-11-21 09:37

NVD link : CVE-2024-45217

Mitre link : CVE-2024-45217

CVE.ORG link : CVE-2024-45217

JSON object : View

Products Affected

No product.

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2024-45217", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-10-16T08:15:05.353", "references": [{"url": "https://solr.apache.org/security.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/10/15/9", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Insecure Default Initialization of Resource vulnerability in Apache Solr.\n\nNew ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the \"trusted\" metadata.\nConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to \"trusted\" ConfigSets that may not have been created with an Authenticated request.\n\"trusted\" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized.\n\nThis issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.\n\nUsers are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise."}, {"lang": "es", "value": "Vulnerabilidad de inicializaci\u00f3n predeterminada insegura de recursos en Apache Solr. Los nuevos ConfigSets que se crean mediante un comando de restauraci\u00f3n, que copian un configSet de la copia de seguridad y le dan un nuevo nombre, se crean sin configurar los metadatos \"confiables\". Los ConfigSets que no contienen el indicador se conf\u00edan impl\u00edcitamente si faltan los metadatos, por lo tanto, esto genera ConfigSets \"confiables\" que pueden no haberse creado con una solicitud autenticada. Los ConfigSets \"confiables\" pueden cargar c\u00f3digo personalizado en los cargadores de clases, por lo tanto, se supone que el indicador solo se establece cuando la solicitud que carga el ConfigSet est\u00e1 autenticada y autorizada. Este problema afecta a Apache Solr: desde 6.6.0 hasta 8.11.4, desde 9.0.0 hasta 9.7.0. Este problema no afecta a las instancias de Solr que est\u00e1n protegidas mediante autenticaci\u00f3n/autorizaci\u00f3n. Se recomienda principalmente a los usuarios que utilicen autenticaci\u00f3n y autorizaci\u00f3n al ejecutar Solr. Sin embargo, actualizar a la versi\u00f3n 9.7.0 o 8.11.4 mitigar\u00e1 este problema."}], "lastModified": "2024-11-21T09:37:28.897", "sourceIdentifier": "security@apache.org"}