GHSA-jgcr-fg3g-qvw8 BIT-solr-2021-29262 CVE-2021-29262
Improper permission handling in Apache Solr
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 6.72%
- Chance of exploitation in the next 30 days. Higher than 93.94% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-279 Incorrect Execution-Assigned Permissions
- CWE-522 Insufficiently Protected Credentials
- Fix
8.8.2- Upgrade org.apache.solr:solr-core to this version or later
Description
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.solr:solr-core | < 8.8.2 |
8.8.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.solr:solr-core Maven → 8.8.2
- maven
<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>8.8.2</version></dependency>- gradle
implementation("org.apache.solr:solr-core:8.8.2")
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-279: Incorrect Execution-Assigned Permissions
While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Other links
- issues.apache.org/jira/browse/SOLR-15249
- lists.apache.org/thread.html/r1171f6417eeb6d5e1206d53e2b2ff2d6ee14026f8b595ef7d8a33b7…
- lists.apache.org/thread.html/r1e92a2eff6c47a65c4a6e95e809a9707181de76f8062403a0bea101…
- lists.apache.org/thread.html/r51b29ff62060b67bc9999ded5e252b36b09311fe5a02d27f6de3e4d…
- lists.apache.org/thread.html/r536da4c4e4e406f7843461cc754a3d0a3fe575aa576e2b71a9cd57d…
- lists.apache.org/thread.html/r7151081abab92a827a607205c4260b0a3d22280b52d15bc90917760…
- lists.apache.org/thread.html/r8d35eeb9a470d2682b5bcf3be0b8942faa7e28f9ca5861c058d17ff…
- lists.apache.org/thread.html/r9c4ce6903218c92ef2583070e64af5a69e483821c4b3016dc41e3c6…
- lists.apache.org/thread.html/rb6db683903174eaa44ec80cc118a38574319b0d4181f36b61ee6278…
- lists.apache.org/thread.html/rbc680cbfd745f22d182158217428a296e8e398cde16f3f428fe4bdd…
- lists.apache.org/thread.html/rd85f87e559ee27e9c69795e3ad93a77621895e0328ea3df41d711d7…
- lists.apache.org/thread.html/ref84e60192f4bdc3206b247f260513e8d4e71f3e200792f75386d07…
- security.netapp.com/advisory/ntap-20210604-0009
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-17558 Improper Input Validation in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| CVE-2019-0193 XML External Entity (XXE) Injection in Apache Solr | High Known exploited | Also affects org.apache.solr:solr-core |
| GHSA-qhr7-h655-pw6r Apache Solr has hardcoded credentials in the Basic Authentication setup tool | Critical | Also affects org.apache.solr:solr-core |
| GHSA-vc2w-4v3p-2mqw Apache Solr: Insufficient file-access checking in standalone core-creation requests | High | Also affects org.apache.solr:solr-core |
| GHSA-qr3p-2xj2-q7hq Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin | High | Also affects org.apache.solr:solr-core |
| GHSA-68r2-fwcg-qpm8 Apache Solr vulnerable to Execution with Unnecessary Privileges | Medium | Also affects org.apache.solr:solr-core |
| GHSA-4p5m-gvpf-f3x5 Apache Solr Relative Path Traversal vulnerability | Medium | Also affects org.apache.solr:solr-core |
| GHSA-37vr-vmg4-jwpw Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | High | Also affects org.apache.solr:solr-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor