Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: • Clusters where bin/solr auth enable was not used to bootstrap BasicAuth • Clusters where template users have been assigned strong passwords after bootstrap
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- CVE published
- Record last updated
Affected versions
- org.apache.solr:solr-core
From 9.4.0 · through 9.10.1
- org.apache.solr:solr-coreMaven
From 9.4.0 · through 9.10.1
- org.apache.solr:solr-coreMaven
10.0.0