CVE-2024-45216

CVE-2024-45216 is a critical improper-authentication flaw (CVSS 9.8) in Apache Solr's PKIAuthenticationPlugin, which is enabled by default whenever Solr Authentication is configured. An attacker sends a request to any protected Solr API URL with a crafted fake ending that looks like an unprotected API path; Solr skips authentication for that request and then strips the fake ending before API routing, so the request is processed as the original protected path. This allows an unauthenticated attacker to reach Solr APIs that should require credentials, potentially exposing or modifying indexed data and configuration, with network access being the only prerequisite. Only Solr deployments that run Solr Authentication on versions 5.3.0 through 8.11.3 or 9.0.0 through 9.6.x are affected; unauthenticated Solr instances are not exposed to this bypass. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 91.7% probability of exploitation within 30 days (100th percentile), so exploitation should be treated as likely imminent.

What to do: Upgrade to Apache Solr 9.7.0 or 8.11.4, which fix the issue. As an interim measure, disable the PKIAuthenticationPlugin or restrict network access to Solr with firewall/allowlist rules, and confirm whether your instances run Solr Authentication and are internet-exposed. Given the 91.7% EPSS, prioritize patching internet-facing Solr servers and review access logs for API requests bearing unusual URL suffixes that bypass authentication.