GHSA-3hwc-rqwp-v36q BIT-solr-2023-50291 CVE-2023-50291
Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 3.28%
- Chance of exploitation in the next 30 days. Higher than 88.43% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-522 Insufficiently Protected Credentials
- Fix
8.11.3- Upgrade org.apache.solr:solr-core to this version or later
Description
Insufficiently Protected Credentials vulnerability in Apache Solr.
This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.
This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, both of which fix the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".
Users who cannot upgrade can also use the following Java system property to fix the issue:
-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.solr:solr-core | >= 6.0.0, < 8.11.3 |
8.11.3 |
| org.apache.solr:solr-core | >= 9.0.0, < 9.3.0 |
9.3.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.solr:solr-core Maven → 8.11.3
- maven
<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>8.11.3</version></dependency>- gradle
implementation("org.apache.solr:solr-core:8.11.3")
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-17558 Improper Input Validation in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| CVE-2019-0193 XML External Entity (XXE) Injection in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| GHSA-qhr7-h655-pw6r Apache Solr has hardcoded credentials in the Basic Authentication setup tool | Critical | Also affects org.apache.solr:solr-core |
| GHSA-vc2w-4v3p-2mqw Apache Solr: Insufficient file-access checking in standalone core-creation requests | High | Also affects org.apache.solr:solr-core |
| GHSA-qr3p-2xj2-q7hq Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin | High | Also affects org.apache.solr:solr-core |
| GHSA-68r2-fwcg-qpm8 Apache Solr vulnerable to Execution with Unnecessary Privileges | Medium | Also affects org.apache.solr:solr-core |
| GHSA-4p5m-gvpf-f3x5 Apache Solr Relative Path Traversal vulnerability | Medium | Also affects org.apache.solr:solr-core |
| GHSA-37vr-vmg4-jwpw Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | High | Also affects org.apache.solr:solr-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor