PT-2024-1632 · Apache · Apache Solr

Michael Taggart · Published 2024-02-08 · Updated 2024-03-06 · CVE-2023-50291

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 6.0.0 through 8.11.2 Apache Solr versions 9.0.0 through 9.2.x

Description The issue is related to insufficient protection of credentials in Apache Solr. One of the endpoints, "/admin/info/properties", was only set up to hide system properties containing the word "password" in their name. However, other sensitive system properties, such as "basicauth" and "aws.secretKey", do not contain "password" and thus their values were published via the "/admin/info/properties" endpoint. This endpoint is protected under the "config-read" permission, and Solr Clouds with Authorization enabled are only vulnerable through logged-in users with the "config-read" permission.

Recommendations Upgrade to version 9.3.0 or 8.11.3, which fixes the issue. For users who cannot upgrade, use the Java system property '-Dsolr.redaction.system.pattern=.(password|secret|basicauth).' to fix the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2024-01302

BIT-SOLR-2023-50291

CVE-2023-50291

GHSA-3HWC-RQWP-V36Q

Affected Products

Apache Solr

References · 22

• https://osv.dev/vulnerability/BIT-solr-2023-50291 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50291 · Security Note
• https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-50291 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-50291 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50291 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50291 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50291 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-50291 · Security Note
• https://osv.dev/vulnerability/GHSA-3hwc-rqwp-v36q · Vendor Advisory
• https://github.com/apache/solr · Note
• https://github.com/apache/solr/commit/98c198810f2cd934d23d0d80aadb570a2bbb3b8e · Note
• https://github.com/apache/solr/commit/659021c7d50164a3166887f24875228431b02102 · Note
• https://twitter.com/oss_security/status/1756040123270017441 · Twitter Post