CVE-2024-52012

CVE-2024-52012 is a relative path traversal ('zipslip') flaw in the 'configset upload' API of Apache Solr, which fails to sanitize file paths inside uploaded ZIP archives. An attacker with low-privileged authenticated access (per the CVSS 3.1 vector's PR:L) can upload a maliciously crafted ZIP whose relative filepaths escape the intended directory and write files to unanticipated parts of the filesystem; this affects only Solr instances running on Windows. Successful exploitation grants arbitrary write access anywhere the Solr process can write, enabling tampering with configuration or other files that could lead to further compromise; the CVSS 3.1 score is 5.4 (medium) with low confidentiality and integrity impact. All Apache Solr versions from 6.6 through 9.7.0 on Windows are affected, and the issue is fixed in version 9.8.0. No public proof-of-concept or in-the-wild exploitation is known and it is not in CISA KEV, but the EPSS score of 47.2% (99th percentile) indicates a high predicted likelihood of exploitation within 30 days.

What to do: Upgrade Apache Solr to version 9.8.0, which fixes the issue. If upgrading is not immediately possible, use Solr's Rule-Based Authentication Plugin to restrict access to the configset upload API so only trusted administrators can reach it. Inventory Windows-hosted Solr instances and verify who can authenticate to and invoke the configset upload API, since exploitation requires low-privileged API access.