Apache Solr Privilege Escalation Vulnerability via Untrusted Config Files

A vulnerability in Apache Solr core creation allows users to replace "trusted" configset files with arbitrary, potentially untrusted files from the filesystem. This issue affects Solr instances using the "FileSystemConfigSetService" component, which is the default in "standalone" or "user-managed" mode", and are running without authentication and authorization. The replacement config files are treated as "trusted" and can include "<lib>" tags to modify Solr's classpath, potentially leading to the execution of malicious code as a search component or other plugin. This vulnerability exists in all Apache Solr versions prior to 9.8.0.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing the execution of untrusted code within Solr, potentially as a search component or plugin. Additionally, it could lead to a denial-of-service condition.

Remediation

Users are advised to upgrade to Apache Solr 9.8.0 or later, which disables the use of "<lib>" tags by default. For those using Solr versions through 9.7, enabling authentication and authorization or switching to SolrCloud can help mitigate this vulnerability.