Apache Solr: Configset upload on Windows allows arbitrary path write-access (CVE-2024-52012)

A relative path traversal vulnerability (CVE-2024-52012) exists in Apache Solr's configset upload API on Windows platforms. Due to insufficient input sanitization, specially crafted ZIP files can exploit this 'zipslip' flaw to write files outside the intended directory, potentially leading to arbitrary file write on the host filesystem. This affects Solr versions >=6.6.0 and <9.8.0. The issue is resolved in version 9.8.0. As an alternative mitigation, access to the vulnerable API can be restricted to trusted users via Solr's Rule-Based Authentication Plugin.

Successful exploitation allows an attacker with access to the configset upload API to write files to arbitrary locations on the filesystem of a Windows host running Apache Solr. This could lead to unauthorized file modification or code execution depending on the files written and the environment. However, no known exploits in the wild have been reported.

Upgrade Apache Solr to version 9.8.0 or later, which contains the official fix for this vulnerability. If upgrading is not immediately possible, restrict access to the configset upload API using Solr's Rule-Based Authentication Plugin to allow only trusted administrators or users to perform uploads, effectively preventing unauthorized exploitation.