Execution with Unnecessary Privileges Affecting org.apache.solr:solr-core package, versions [,9.8.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHESOLR-8663426
- published27 Jan 2025
- disclosed27 Jan 2025
- creditpwn null
Introduced: 27 Jan 2025
NewCVE-2025-24814 (opens in a new tab)How to fix?
Upgrade org.apache.solr:solr-core to version 9.8.0 or higher.
Overview
org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene
Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to the potential for attackers to control what configset is loaded by the FileSystemConfigSetService component (in use by default in standalone and user-managed modes) during core creation. A trusted config can be replaced by a malicious one, which specifies arbitrary classes as <lib> elements, which will then be added to the classpath.
Workaround
This vulnerability can be mitigated by enforcing authorization on the affected cluster, and avoided entirely by using SolrCloud rather than FileSystemConfigSetService.