Executive Summary

This vulnerability involves hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0. These default credentials are installed silently alongside the user-specified account, allowing a remote attacker to gain full administrative access to the Solr cluster.

The issue arises because template users such as superadmin, admin, search, and index have default passwords that can be exploited if not changed or removed.

An immediate workaround without upgrading is to delete these template users from the security.json file or change their passwords. Future versions 9.11.0 and 10.1.0 will fix this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote attacker to gain full administrative access to your Apache Solr cluster without authorization.

With full administrative access, the attacker can compromise confidentiality, integrity, and availability of the data and services managed by the Solr cluster.

This could lead to unauthorized data access, data modification, service disruption, or further exploitation within your environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves hardcoded default credentials in the Basic Authentication setup tool of Apache Solr. Detection can be performed by checking if the vulnerable versions (9.4.0 through 9.10.1 and 10.0.0) are in use and if the default template users (superadmin, admin, search, index) exist with their default passwords.

You can inspect the security.json file in your Solr configuration to see if these template users are present and whether their passwords have been changed.

While no specific commands are provided in the context, a general approach would be to use commands to read and search the security.json file, for example:

• cat /path/to/solr/security.json | grep -E 'superadmin|admin|search|index'
• Check Solr version with: bin/solr --version

Additionally, attempting to authenticate using the known default credentials against the Solr cluster could help confirm vulnerability presence.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps without upgrading include deleting the template users (superadmin, admin, search, index) from the security.json file or changing their passwords to strong, unique values.

Upgrading to future versions 9.11.0 or 10.1.0, which are not vulnerable, will fully resolve the issue.

Clusters that did not use the bin/solr auth enable tool to bootstrap BasicAuth or where template users have already been assigned strong passwords are not affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote attacker to gain full administrative access to the Apache Solr cluster via hardcoded default credentials. Such unauthorized access can lead to exposure, modification, or deletion of sensitive data.

Because of the potential for unauthorized data access and control, this vulnerability could negatively impact compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict access controls and protection of sensitive information.

Mitigations include deleting the template users or changing their passwords, or upgrading to fixed versions, which are necessary steps to maintain compliance.

Useful 0 Not Useful 0