Apache Solr Rule Based Authorization Plugin Unauthorized Access Vulnerability

A vulnerability exists in Apache Solr versions 5.3.0 through 9.10.0 that use the Rule Based Authorization Plugin. This vulnerability allows unauthorized access to certain Solr APIs due to inadequate input validation. The issue affects deployments that specify multiple roles in their RuleBasedAuthorizationPlugin configuration, use certain pre-defined permission rules, do not define the 'all' permission, and have a networking setup that allows unfiltered client requests to Solr.

Impact

Exploitation of this vulnerability could lead to unauthorized access to Solr APIs, potentially allowing users to perform actions or access data they should not be permitted to.

Remediation

Users can mitigate this vulnerability by updating their RuleBasedAuthorizationPlugin configuration to include the 'all' permission and associating it with an 'admin' or other privileged role. Alternatively, users can upgrade to Apache Solr version 9.10.1 or later.