CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr.<br /> <br /> This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0.<br /> One of the two endpoints that publishes the Solr process&amp;#39; Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name.<br /> There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint.<br /> This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.<br /> <br /> This /admin/info/properties endpoint is protected under the "config-read" permission.<br /> Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission.<br /> Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue.<br /> A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps".<br /> By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".<br /> <br /> Users who cannot upgrade can also use the following Java system property to fix the issue:<br />   &amp;#39;-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*&amp;#39;