PT-2024-1138 · Apache · Apache Solr

Published 2024-01-12 · Updated 2025-05-09 · CVE-2023-50290

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 9.0.0 through 9.3.0

Description The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. Approximately 319,082 results are mainly distributed in China, the United States, and other countries.

Recommendations Upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API. As a temporary workaround, consider restricting access to the Solr Metrics API for users without the "metrics-read" permission.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-00451

BIT-SOLR-2023-50290

CVE-2023-50290

GHSA-GG7W-PW2R-X2CQ

Affected Products

Apache Solr

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2023-50290 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-50290 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50290 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gg7w-pw2r-x2cq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2023-50290 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00451 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50290 · Vendor Advisory
• https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50290 · Security Note
• https://github.com/apache/lucene-solr · Note
• https://github.com/apache/solr/commit/35fc4bdc48171d9a64251c54a1e76deb558cf9d8 · Note
• https://twitter.com/zoomeye_team/status/1746840249454739922 · Twitter Post
• https://t.me/cvenotify/67456 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024011424 · Note
• https://twitter.com/the_yellow_fall/status/1745996394098516478 · Twitter Post