Vulnerability Details CVE-2023-50291
Insufficiently Protected Credentials vulnerability in Apache Solr.
This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0.
One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name.
There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint.
This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.
This /admin/info/properties endpoint is protected under the "config-read" permission.
Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission.
Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue.
A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps".
By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".
Users who cannot upgrade can also use the following Java system property to fix the issue:
'-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 51.2%
CVSS Severity
CVSS v3 Score 7.5
References
- http://www.openwall.com/lists/oss-security/2024/02/09/4
- https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies
- http://www.openwall.com/lists/oss-security/2024/02/09/4
- https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies
Products affected by CVE-2023-50291
-
cpe:2.3:a:apache:solr:6.0.0
-
cpe:2.3:a:apache:solr:6.0.1
-
cpe:2.3:a:apache:solr:6.1.0
-
cpe:2.3:a:apache:solr:6.2.0
-
cpe:2.3:a:apache:solr:6.2.1
-
cpe:2.3:a:apache:solr:6.3.0
-
cpe:2.3:a:apache:solr:6.4.0
-
cpe:2.3:a:apache:solr:6.4.1
-
cpe:2.3:a:apache:solr:6.4.2
-
cpe:2.3:a:apache:solr:6.5.0
-
cpe:2.3:a:apache:solr:6.5.1
-
cpe:2.3:a:apache:solr:6.6.0
-
cpe:2.3:a:apache:solr:6.6.1
-
cpe:2.3:a:apache:solr:6.6.2
-
cpe:2.3:a:apache:solr:6.6.3
-
cpe:2.3:a:apache:solr:6.6.4
-
cpe:2.3:a:apache:solr:6.6.5
-
cpe:2.3:a:apache:solr:6.6.6
-
cpe:2.3:a:apache:solr:7.0.0
-
cpe:2.3:a:apache:solr:7.0.1
-
cpe:2.3:a:apache:solr:7.1.0
-
cpe:2.3:a:apache:solr:7.2.0
-
cpe:2.3:a:apache:solr:7.2.1
-
cpe:2.3:a:apache:solr:7.3.0
-
cpe:2.3:a:apache:solr:7.3.1
-
cpe:2.3:a:apache:solr:7.4.0
-
cpe:2.3:a:apache:solr:7.5.0
-
cpe:2.3:a:apache:solr:7.6.0
-
cpe:2.3:a:apache:solr:7.7.0
-
cpe:2.3:a:apache:solr:7.7.1
-
cpe:2.3:a:apache:solr:7.7.2
-
cpe:2.3:a:apache:solr:7.7.3
-
cpe:2.3:a:apache:solr:8.0.0
-
cpe:2.3:a:apache:solr:8.1.0
-
cpe:2.3:a:apache:solr:8.1.1
-
cpe:2.3:a:apache:solr:8.1.2
-
cpe:2.3:a:apache:solr:8.10.0
-
cpe:2.3:a:apache:solr:8.10.1
-
cpe:2.3:a:apache:solr:8.11.0
-
cpe:2.3:a:apache:solr:8.11.1
-
cpe:2.3:a:apache:solr:8.11.2
-
cpe:2.3:a:apache:solr:8.2.0
-
cpe:2.3:a:apache:solr:8.3.0
-
cpe:2.3:a:apache:solr:8.3.1
-
cpe:2.3:a:apache:solr:8.4.0
-
cpe:2.3:a:apache:solr:8.4.1
-
cpe:2.3:a:apache:solr:8.5.0
-
cpe:2.3:a:apache:solr:8.5.1
-
cpe:2.3:a:apache:solr:8.5.2
-
cpe:2.3:a:apache:solr:8.6.0
-
cpe:2.3:a:apache:solr:8.6.1
-
cpe:2.3:a:apache:solr:8.6.2
-
cpe:2.3:a:apache:solr:8.6.3
-
cpe:2.3:a:apache:solr:8.8.1
-
cpe:2.3:a:apache:solr:8.8.2
-
cpe:2.3:a:apache:solr:8.9
-
cpe:2.3:a:apache:solr:9.0.0
-
cpe:2.3:a:apache:solr:9.1.0
-
cpe:2.3:a:apache:solr:9.1.1
-
cpe:2.3:a:apache:solr:9.2.0
-
cpe:2.3:a:apache:solr:9.2.1