CVE-2024-52012

Summary

CVE-2024-52012 is a Relative Path Traversal vulnerability affecting Apache Solr versions 6.6 through 9.7.0. This issue, also known as a "zipslip" vulnerability, allows attackers to write data to unintended locations in the filesystem by constructing maliciously crafted ZIP files with relative filepaths. Specifically, Solr instances running on Windows are susceptible to arbitrary filepath write-access due to insufficient input sanitization in the "configset upload" API. To mitigate this risk, users can upgrade to Apache Solr version 9.8.0, which patches the vulnerability. Alternatively, implementing Solr's "Rule-Based Authentication Plugin" and restricting access to the configset upload API to a trusted set of administrators/users can help prevent the issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.