SB2025012737 - Multiple vulnerabilities in Apache Solr

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2024-52012)

The vulnerability allows a remote user to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when handling ZIP files passed via "configset upload" API. A remote user can upload a specially crafted ZIP archive and overwrite arbitrary files on the system (a.k.a. zipslip attack).

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-24814)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error when handling configuration files. Solr instances that use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2025/01/26/2
• https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd
• https://lists.apache.org/thread/wmwjrjj969rtvn84m7zdby17ht29c4lr