CVE-2023-50291: Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords
Apache Solr could allow a remote authenticated attacker to obtain sensitive information, caused by system property redaction logic inconsistencies. By using the /admin/info/properties endpoint, an attacker could exploit his vulnerability to leak certain passwords.
Other sources
Insufficiently Protected Credentials vulnerability in Apache Solr.
This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.
This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, both of which fix the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".
Users who cannot upgrade can also use the following Java system property to fix the issue: -Dsolr.redaction.system.pattern=.(password|secret|basicauth).
— GitHub
Insufficiently Protected Credentials vulnerability in Apache Solr.
This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.
This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".
Users who cannot upgrade can also use the following Java system property to fix the issue: '-Dsolr.redaction.system.pattern=.(password|secret|basicauth).'
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50291?
CVE-2023-50291 is considered a high severity vulnerability due to its potential to leak sensitive information.
How can I fix CVE-2023-50291?
To fix CVE-2023-50291, upgrade Apache Solr to version 9.3.0 or 8.11.3 to eliminate the vulnerability.
What type of attack does CVE-2023-50291 involve?
CVE-2023-50291 allows remote authenticated attackers to exploit the vulnerability to leak passwords via the /admin/info/properties endpoint.
Which versions of Apache Solr are affected by CVE-2023-50291?
CVE-2023-50291 affects Apache Solr versions between 9.0.0 and 9.3.0 and 6.0.0 and 8.11.3.
Who is the vendor responsible for CVE-2023-50291?
The vendor responsible for CVE-2023-50291 is Apache, which maintains the Solr project.