CVE-2023-50292
Published: 09 February 2024
Summary
CVE-2023-50292 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Apache Solr. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-50292 is an incorrect permission assignment and improper control of dynamically-managed code resources vulnerability in Apache Solr. It affects the Schema Designer feature in versions 8.10.0 through 8.11.2 and 9.0.0 before 9.3.0. The flaw stems from the Schema Designer loading configSets without verifying their trusted status, which is normally granted only to those created by authenticated users; this oversight permits unauthenticated configSets to load external libraries.
Unauthenticated remote attackers can exploit the issue over the network without authentication or user interaction. By supplying or referencing an untrusted configSet through the Schema Designer, they can trigger external library loading that would otherwise be restricted, resulting in high-impact confidentiality exposure as reflected in the CVSS 7.5 rating.
Apache Solr security advisories direct users to upgrade to version 9.3.0 to resolve the permission check omission. The referenced OSS-Security mailing list postings and the project security page reiterate the same upgrade guidance and note the affected range.
The associated EPSS score has reached a peak of 0.4667 with a current value of 0.4645, indicating sustained moderate exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0513
Vulnerability details
Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily…
more
configure and test new Schemas and configSets. However, when the feature was created, the "trust" (authentication) of these configSets was not considered. External library loading is only available to configSets that are "trusted" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution. Since the Schema Designer loaded configSets without taking their "trust" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer. Users are recommended to upgrade to version 9.3.0, which fixes the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.