Unrestricted Upload of File with Dangerous Type Affecting org.apache.solr:solr-core package, versions [6.0.0,8.11.3)[9.0.0,9.4.1)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
86.68% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Unrestricted Upload of File with Dangerous Type vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGAPACHESOLR-6241715
  • published11 Feb 2024
  • disclosed9 Feb 2024
  • creditL3yx

Introduced: 9 Feb 2024

CVE-2023-50386  (opens in a new tab)
CWE-434  (opens in a new tab)

How to fix?

Upgrade org.apache.solr:solr-core to version 8.11.3, 9.4.1 or higher.

Overview

org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene

Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type due to the ConfigSets API accepting Java jar and class files. When backing up Solr Collections, these configSet files are saved to disk using the LocalFileSystemRepository, which is the default for backups. If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files become available for use with any ConfigSet, regardless of trust level.

Note: This vulnerability is most severe when Authorization is not enabled, which is strongly recommended against. With Authorization enabled it is limited to extending the Backup permissions with the ability to add libraries.

CVSS Scores

version 3.1