GHSA-gg7w-pw2r-x2cq BIT-solr-2023-50290 CVE-2023-50290
Apache Solr allows read access to host environmet variables
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 68.45%
- Chance of exploitation in the next 30 days. Higher than 99.33% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Fix
9.3.0- Upgrade org.apache.solr:solr-core to this version or later
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.
The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.
Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.solr:solr-core | >= 9.0.0, < 9.3.0 |
9.3.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.solr:solr-core Maven → 9.3.0
- maven
<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>9.3.0</version></dependency>- gradle
implementation("org.apache.solr:solr-core:9.3.0")
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-17558 Improper Input Validation in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| CVE-2019-0193 XML External Entity (XXE) Injection in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| GHSA-qhr7-h655-pw6r Apache Solr has hardcoded credentials in the Basic Authentication setup tool | Critical | Also affects org.apache.solr:solr-core |
| GHSA-vc2w-4v3p-2mqw Apache Solr: Insufficient file-access checking in standalone core-creation requests | High | Also affects org.apache.solr:solr-core |
| GHSA-qr3p-2xj2-q7hq Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin | High | Also affects org.apache.solr:solr-core |
| GHSA-68r2-fwcg-qpm8 Apache Solr vulnerable to Execution with Unnecessary Privileges | Medium | Also affects org.apache.solr:solr-core |
| GHSA-4p5m-gvpf-f3x5 Apache Solr Relative Path Traversal vulnerability | Medium | Also affects org.apache.solr:solr-core |
| GHSA-37vr-vmg4-jwpw Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | High | Also affects org.apache.solr:solr-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor