// For flags

CVE-2023-50292

Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.

This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0.

The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets.
However, when the feature was created, the "trust" (authentication) of these configSets was not considered.
External library loading is only available to configSets that are "trusted" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution.
Since the Schema Designer loaded configSets without taking their "trust" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer.

Users are recommended to upgrade to version 9.3.0, which fixes the issue.

Asignación de permisos incorrecta para recursos críticos, vulnerabilidad de control inadecuado de recursos de código administrados dinámicamente en Apache Solr. Este problema afecta a Apache Solr: desde 8.10.0 hasta 8.11.2, desde 9.0.0 antes de 9.3.0. Schema Designer se introdujo para permitir a los usuarios configurar y probar más fácilmente nuevos esquemas y conjuntos de configuración. Sin embargo, cuando se creó la función, no se consideró la "confianza" (autenticación) de estos conjuntos de configuración. La carga de librerías externas solo está disponible para conjuntos de configuración que son "confiables" (creados por usuarios autenticados), por lo que los usuarios no autenticados no pueden realizar la ejecución remota de código. Dado que Schema Designer cargó configSets sin tener en cuenta su "confianza", a los configSets que fueron creados por usuarios no autenticados se les permitió cargar librerías externas cuando se usaron en Schema Designer. Se recomienda a los usuarios actualizar a la versión 9.3.0, que soluciona el problema.

*Credits: Skay
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-06 CVE Reserved
  • 2024-02-09 CVE Published
  • 2024-03-13 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Solr
Search vendor "Apache" for product "Solr"
 >= 6.0.0 < 8.11.3
Search vendor "Apache" for product "Solr" and version " >= 6.0.0 < 8.11.3"
-
Affected
Apache
Search vendor "Apache"
 Solr
Search vendor "Apache" for product "Solr"
 >= 9.0.0 < 9.4.1
Search vendor "Apache" for product "Solr" and version " >= 9.0.0 < 9.4.1"
-
Affected