gagaltotal/CVE-2026-44825-Apache-Solr-Scanner

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based scanner that detects Apache Solr instances, checks for authentication, attempts default credential brute-force, and optionally executes a Velocity template RCE payload. The primary operation is detection and credential validation, with exploitation as an optional secondary mode.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code implements a scanner and optional exploit for CVE-2026-44825 (hardcoded credentials in Apache Solr). The code performs network scanning, credential brute-forcing against known default users, and, when requested, sends a Velocity template payload for remote command execution against the target Solr instance. All behavior is consistent with the stated purpose of a security testing tool. No concealed backdoor, unrelated remote access, persistence mechanism, or operator-directed harm beyond the declared exploit functionality was observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesGo
Target softwareApache Solr
Attack typesdefault credentialsremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The tool's primary stated purpose is scanning and detection: 'This repository contains a Go-based scanner for detecting and testing Apache Solr instances' (README.md:3). The code implements detection, version extraction, authentication checks, and credential brute-forcing. Exploitation is an optional flag-driven mode (--exploit, --rce) and is not the default behavior. The tool is classified as a scanner because its core operation is to identify and report vulnerable targets, not to directly exploit them without explicit user invocation.

README.md:3solr_main.go:803-804

Requirements

  • Network access to a target Apache Solr instanceREADME.md:25
  • Target must be running Apache Solr with BasicAuth enabled and default credentials presentsolr_main.go:50-51

Observed behavior

  • Normalizes target URLs and appends /solr if missingsolr_main.go:108-125
  • Detects Solr by requesting /admin/info/system and checking response body and server header for 'solr'solr_main.go:218-249
  • Checks for authentication by looking for 401 responses on admin endpointssolr_main.go:260-277
  • Brute-forces default credentials using hardcoded template users (superadmin, admin, search, index) and a password listsolr_main.go:50-51solr_main.go:576-597
  • Optionally executes a Velocity template RCE payload using discovered credentials or user-supplied credentialssolr_main.go:412-430solr_main.go:432-464
  • Exports scan results to a JSON filesolr_main.go:690-699
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential List
templateUsers: ["superadmin", "admin", "search", "index"]; passwordList: ["SolrRocks", "solr", "Solr123", "admin", "password", "changeme", "secret", "solradmin"]Hardcoded credential lists used for brute-force authentication against detected Solr instances, directly related to the CVE-2026-44825 vulnerability.solr_main.go:50-51
Exploit Payload
Velocity template RCE payload built in buildRCEPayload() and sent via POST to /<core>/selectThe tool constructs and sends a Velocity template injection payload to execute arbitrary shell commands on the target Solr server when the --exploit or --rce flags are used.solr_main.go:412-430solr_main.go:432-464
Network Behavior
HTTP requests to /admin/info/system, /admin/cores?action=STATUS, /admin/collections?action=LIST, and /<core>/selectThe scanner probes standard Solr API endpoints for detection, authentication checks, and RCE delivery, all within the scope of the declared CVE testing.solr_main.go:219solr_main.go:262solr_main.go:271solr_main.go:449
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (README.md and solr_main.go); two additional files (go.mod and a non-text media file) are present in the repository but not included in the packet.
  • The non-text media file (698855 bytes) is flagged as metadata only and not analyzed, which may contain additional context.
  • The analysis is based solely on static source code review; no dynamic execution or verification of the tool's behavior was performed.
  • One non-text media file (images/Screenshot from 2026-07-08 23-44-47.png, 698855 bytes) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
  • One unclassified file (366 bytes) was present in the repository but not included in the text evidence; its content and purpose are unknown.
  • The compiled binary (solr_scanner) was not provided or analyzed; the review is based solely on the supplied source code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1