Rule Based Authorization Plugin
Deployments of Apache Solr utilizing the Rule Based Authorization Plugin are susceptible to unauthorized access to certain Solr APIs. This occurs due to insufficient input validation within the plugin's components. The issue is present only when specific conditions are met: the use of the RuleBasedAuthorizationPlugin, a configuration specifying multiple roles, a permission list utilizing predefined rules like "config-read", "config-edit", "schema-read", "metrics-read", or "security-read", the absence of the "all" predefined permission in the permission list, and a network setup allowing unfiltered client requests to Solr. The vulnerability allows attackers to bypass access controls on administrative endpoints by exploiting a logic flaw.