CVE-2024-45217 in Solr
Summary
by MITRE • 10/16/2024
Insecure Default Initialization of Resource vulnerability in Apache Solr.
New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized.
This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.
Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/11/2026
The vulnerability described in CVE-2024-45217 represents a critical Insecure Default Initialization of Resource flaw within Apache Solr that undermines the security model of configuration management. This issue specifically impacts the ConfigSet restoration functionality where new configurations created through restore operations inherit default properties that do not properly validate authentication status. The vulnerability stems from the implicit trust assigned to ConfigSets when the "trusted" metadata flag is absent, creating a scenario where unauthorized configuration modifications can occur without proper authorization checks.
The technical flaw manifests in the configuration set management system where the restore command copies existing configuration sets from backup locations but fails to explicitly set the "trusted" metadata flag during the creation process. This default initialization behavior creates a security gap where ConfigSets that should require authenticated access are implicitly trusted due to missing metadata validation. The implicit trust mechanism operates under the assumption that missing metadata indicates a trusted state, which directly contradicts the intended security architecture where only authenticated and authorized requests should be permitted to create trusted configurations. This vulnerability directly relates to CWE-200, which addresses improper handling of security-sensitive data, and specifically targets the CWE-359 category concerning exposure of private information through improper resource initialization.
The operational impact of this vulnerability extends beyond simple configuration management issues, as it creates a potential code execution pathway through the classloader mechanism. ConfigSets marked as trusted are permitted to load custom code into the classloader environment, making this vulnerability particularly dangerous when exploited by unauthorized actors. The implicit trust model allows malicious actors to potentially inject unauthorized code through compromised configuration sets, especially in environments where authentication and authorization are not properly implemented. This vulnerability affects multiple versions of Apache Solr, specifically targeting releases from 6.6.0 before 8.11.4 and from 9.0.0 before 9.7.0, creating a significant attack surface across several major release lines.
The security implications of this vulnerability align with ATT&CK technique T1059.007, which covers "Command and Scripting Interpreter: Python," as the ability to load custom code through trusted ConfigSets creates opportunities for malicious code execution. Additionally, this vulnerability maps to ATT&CK technique T1543.003, covering "Create or Modify System Process: Windows Service," as the classloader manipulation capabilities can enable persistence mechanisms. Organizations running Solr without proper authentication and authorization mechanisms are particularly vulnerable, as the implicit trust model provides a direct path for privilege escalation through configuration management. The vulnerability's exploitation requires minimal prerequisites beyond access to the restore functionality, making it an attractive target for attackers seeking to establish persistent access to Solr environments.
Mitigation strategies for CVE-2024-45217 focus on both immediate remediation and long-term architectural improvements. The primary recommendation involves upgrading to Apache Solr versions 9.7.0 or 8.11.4, which contain the necessary patches to properly initialize the "trusted" metadata flag during ConfigSet creation. Organizations should also implement mandatory authentication and authorization mechanisms for all Solr operations, as the vulnerability does not affect instances properly secured with these controls. Additional protective measures include implementing network segmentation to limit access to Solr configuration endpoints, regular monitoring of configuration set changes, and establishing proper access controls for backup storage systems. The fix addresses the root cause by ensuring that ConfigSets created through restore operations explicitly set the trusted flag based on authentication status, preventing the implicit trust model from creating security vulnerabilities in unauthenticated scenarios.