CVE-2025-24814 (GCVE-0-2025-24814)

Vulnerability from cvelistv5 – Published: 2025-01-27 08:58 – Updated: 2025-02-15 00:10
VLAI
Title
Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
Summary
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-250 - Execution with Unnecessary Privileges
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Solr Affected: 0 , ≤ 9.7 (semver)
Create a notification for this product.
Credits
pwn null
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-15T00:10:36.558Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/01/26/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250214-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-27T14:10:58.492586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-06T16:02:37.895Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Solr",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pwn null"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCore creation allows users to replace \"trusted\" configset files with arbitrary configuration\u003c/p\u003eSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u0026nbsp; These replacement config files are treated as \"trusted\" and can use \"\u0026lt;lib\u0026gt;\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\u003cbr\u003e\u003cbr\u003eThis issue affects all Apache Solr versions up through Solr 9.7.\u0026nbsp; Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").\u0026nbsp; Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\u0026lt;lib\u0026gt;\" tags by default.\u003cbr\u003e"
            }
          ],
          "value": "Core creation allows users to replace \"trusted\" configset files with arbitrary configuration\n\nSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00a0 These replacement config files are treated as \"trusted\" and can use \"\u003clib\u003e\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\n\nThis issue affects all Apache Solr versions up through Solr 9.7.\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\u003clib\u003e\" tags by default."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-27T08:58:08.768Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Solr: Core-creation with \"trusted\" configset can use arbitrary untrusted files",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-24814",
    "datePublished": "2025-01-27T08:58:08.768Z",
    "dateReserved": "2025-01-24T12:48:40.114Z",
    "dateUpdated": "2025-02-15T00:10:36.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-24814",
      "date": "2026-06-07",
      "epss": "0.00777",
      "percentile": "0.74021"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-24814\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-01-27T09:15:14.947\",\"lastModified\":\"2025-06-25T16:41:43.923\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Core creation allows users to replace \\\"trusted\\\" configset files with arbitrary configuration\\n\\nSolr instances that (1) use the \\\"FileSystemConfigSetService\\\" component (the default in \\\"standalone\\\" or \\\"user-managed\\\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \\\"trusted\\\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u00a0 These replacement config files are treated as \\\"trusted\\\" and can use \\\"\u003clib\u003e\\\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\\n\\nThis issue affects all Apache Solr versions up through Solr 9.7.\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \\\"FileSystemConfigSetService\\\").\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \\\"\u003clib\u003e\\\" tags by default.\"},{\"lang\":\"es\",\"value\":\"Core creation permite a los usuarios reemplazar archivos de configuraci\u00f3n \\\"confiables\\\" con instancias Solr de configuraci\u00f3n arbitraria que (1) usan el componente \\\"FileSystemConfigSetService\\\" (el valor predeterminado en modo \\\"aut\u00f3nomo\\\" o \\\"administrado por el usuario\\\") y (2) se ejecutan sin autenticaci\u00f3n ni autorizaci\u00f3n y son vulnerables a una especie de escalada de privilegios en la que los archivos de configuraci\u00f3n \\\"confiables\\\" individuales pueden ignorarse a favor de reemplazos potencialmente no confiables disponibles en otras partes del sistema de archivos. Estos archivos de configuraci\u00f3n de reemplazo se tratan como \\\"confiables\\\" y pueden usar etiquetas \\\"\\\" para agregarlos a la ruta de clase de Solr, que un atacante podr\u00eda usar para cargar c\u00f3digo malicioso como un searchComponent u otro complemento. Este problema afecta a todas las versiones de Apache Solr hasta Solr 9.7. Los usuarios pueden protegerse contra la vulnerabilidad habilitando la autenticaci\u00f3n y la autorizaci\u00f3n en sus cl\u00fasteres Solr o cambiando a SolrCloud (y dejando de lado \\\"FileSystemConfigSetService\\\"). Tambi\u00e9n se recomienda a los usuarios actualizar a Solr 9.8.0, que mitiga este problema al deshabilitar el uso de etiquetas \\\"\\\" de forma predeterminada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":3.4},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.8.0\",\"matchCriteriaId\":\"D59403D1-1B17-4DF8-9100-F3A87BCA78B1\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/01/26/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20250214-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/01/26/1\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250214-0002/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-02-15T00:10:36.558Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-24814\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-27T14:10:58.492586Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-27T14:10:47.663Z\"}}], \"cna\": {\"title\": \"Apache Solr: Core-creation with \\\"trusted\\\" configset can use arbitrary untrusted files\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"pwn null\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Solr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.7\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Core creation allows users to replace \\\"trusted\\\" configset files with arbitrary configuration\\n\\nSolr instances that (1) use the \\\"FileSystemConfigSetService\\\" component (the default in \\\"standalone\\\" or \\\"user-managed\\\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \\\"trusted\\\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\\u00a0 These replacement config files are treated as \\\"trusted\\\" and can use \\\"\u003clib\u003e\\\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\\n\\nThis issue affects all Apache Solr versions up through Solr 9.7.\\u00a0 Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \\\"FileSystemConfigSetService\\\").\\u00a0 Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \\\"\u003clib\u003e\\\" tags by default.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCore creation allows users to replace \\\"trusted\\\" configset files with arbitrary configuration\u003c/p\u003eSolr instances that (1) use the \\\"FileSystemConfigSetService\\\" component (the default in \\\"standalone\\\" or \\\"user-managed\\\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \\\"trusted\\\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.\u0026nbsp; These replacement config files are treated as \\\"trusted\\\" and can use \\\"\u0026lt;lib\u0026gt;\\\" tags to add to Solr\u0027s classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\u003cbr\u003e\u003cbr\u003eThis issue affects all Apache Solr versions up through Solr 9.7.\u0026nbsp; Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \\\"FileSystemConfigSetService\\\").\u0026nbsp; Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \\\"\u0026lt;lib\u0026gt;\\\" tags by default.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"CWE-250 Execution with Unnecessary Privileges\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-01-27T08:58:08.768Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-24814\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-15T00:10:36.558Z\", \"dateReserved\": \"2025-01-24T12:48:40.114Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-01-27T08:58:08.768Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.