PT-2024-1943 · Apache · Apache Solr

L3Yx · Published 2024-02-09 · Updated 2024-12-23 · CVE-2023-50386

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Solr versions 6.0.0 through 8.11.2 Apache Solr versions 9.0.0 through 9.4.0

Description The issue is related to improper control of dynamically-managed code resources, unrestricted upload of files with dangerous types, and inclusion of functionality from untrusted control spheres in Apache Solr. This vulnerability allows an attacker to execute arbitrary code in the system. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository. If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. The vulnerability is limited to extending the Backup permissions with the ability to add libraries when Solr is run in a secure way with Authorization enabled.

Recommendations To resolve the issue, upgrade to version 8.11.3 or 9.4.1, which fix the issue by adding protections such as restricting the upload of files to a configSet that could be executed via a Java ClassLoader and restricting the saving of backups to directories used in the ClassLoader. For versions 6.0.0 through 8.11.2, upgrade to version 8.11.3. For versions 9.0.0 through 9.4.0, upgrade to version 9.4.1.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-913

CWE-434

Related Identifiers

BDU:2024-01738

BIT-SOLR-2023-50386

CVE-2023-50386

GHSA-37VR-VMG4-JWPW

Affected Products

Apache Solr

References · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_solr_backup_restore.rb · Exploit
• 🔥 https://github.com/vvmdx/Apache-Solr-RCE_CVE-2023-50386_POC · Exploit
• https://solr.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50386 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2023-50386 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50386 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50386 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-50386 · Security Note
• https://bdu.fstec.ru/vul/2024-01738 · Security Note
• https://osv.dev/vulnerability/GHSA-37vr-vmg4-jwpw · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50386 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-50386 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-50386 · Vendor Advisory
• https://github.com/apache/lucene-solr/commit/7e9a2e67f812032a049836c3aa0b18bf5cd717f9 · Note
• https://github.com/apache/lucene-solr/commit/6c8f24eb9e3fe1cb19058173f2e221de3febfeda · Note