CVE-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

What is CVE-2023-50291?

CVE-2023-50291 is a high-severity vulnerability in Apache Solr, published on 9 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficiently Protected Credentials vulnerability in Apache Solr.

This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.

This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".

Users who cannot upgrade can also use the following Java system property to fix the issue:   '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'

Weakness: CWE-522

Which versions are affected by CVE-2023-50291?

5 open source packages ship an affected version, including org.apache.solr:solr-core and solr. It affects 1 product.

Products include Apache Solr.

How do I fix CVE-2023-50291?

Upgrade org.apache.solr:solr-core to a fixed version for your release line: 8.11.3 or 9.3.0.

Is CVE-2023-50291 being exploited?

There is no known exploitation of CVE-2023-50291 in the wild and no public exploit code.

Other vulnerabilities in Apache Solr

• CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Exploited High 7.5
• CVE-2019-0193 Apache Solr DataImportHandler Code Injection Exploited High 7.2
• CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending Critical 9.8
• CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler Critical 9.8
• CVE-2021-27905 SSRF vulnerability with the Replication handler Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-solr-2023-50291, DEBIAN-CVE-2023-50291, GHSA-3hwc-rqwp-v36q, UBUNTU-CVE-2023-50291.