CVE-2023-50290
Apache Solr: Host environment variables are published via the Metrics API
Reported by apache · Published January 15, 2024
solr-core is fixed in 9.3.0 (Maven Central)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.solr:solr-core | Maven Central | 9.3.0 |
| solr | Bitnami | 9.3.0 |
| Apache Solr | Apache Software Foundation | 9.3.0 |
| solr | Bitnami | 9.3.0 |
| solr | apache | 9.3.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Solr | 9.0.0 |
| Maven | org.apache.solr:solr-core | 9.0.0 |
| Apache Software Foundation | Apache Solr | 9.0.0 |
Timeline
- Jan 12, 2024 PoC Published (7 in total, the first dated here)
- Jan 14, 2024 CVE Published
- Jan 16, 2024 Nuclei Template
- Jan 16, 2024 Fix Commit
- Jan 17, 2024 EPSS Score (30 in total, the first dated here)
- Oct 5, 2024 Coalition ESS Score (25 in total, the first dated here)
- Nov 19, 2025 CVE Updated
- Mar 17, 2026 Security Advisory (2 in total, the first dated here)
- Aug 10, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-50290
vulnetix vdb fixes CVE-2023-50290Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-50290/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- vendor-advisory
- bug-bounty-reports-desai-vinayak exploit
- Weaponized CVE-2023-50290 in Nuclei exploit
- https://nvd.nist.gov/vuln/detail/CVE-2023-50290 advisory
- https://github.com/apache/solr/commit/35fc4bdc48171d9a64251c54a1e76deb558cf9d8 patch
- https://issues.apache.org/jira/browse/SOLR-16808 url
- https://github.com/advisories/GHSA-gg7w-pw2r-x2cq advisory